combine query_string and aggregations

Question

I have documents from different applications in one index, with application name a field in each document. Now I want to count the number of documents per application per day. The application name is in string format, so I cannot use a filter term for it. While the below GET query does the filtering per application

{
  "query": {
    "filtered": {
      "query": {
        "query_string": {
           "query": "+environmentType:prod +application:app1",
           "analyze_wildcard": true
        }
      }
    }
  }
}

and I can use this aggregation for simple daily counts

{
  "aggs": {
    "simpleDatehHistogram": {
      "date_histogram": {
        "field": "timestamp",
        "interval": "day"
      }
    }
  }
}

I don't seem to be able to combine them so that the application filter is applied to my aggregation results.

This is the mapping of my index.

{
  "myIndex" : {
    "mappings" : {
      "myType" : {
        "properties" : {
          "application" : {
            "type" : "string"
          },
          "environmentType" : {
            "type" : "string"
          },
          "event" : {
            "properties" : {
              "Id" : {
                "type" : "long"
              },
              "documentId" : {
                "type" : "string"
              },
            }
          },
          "hostname" : {
            "type" : "string"
          },
          "id" : {
            "type" : "string"
          },
          "timestamp" : {
            "type" : "date",
            "format" : "dateOptionalTime"
          },
          "timestampEpoch" : {
            "type" : "long"
          },
          "type" : {
            "type" : "string"
          },
          "version" : {
            "type" : "string"
          }
        }
      }
    }
  }
}

jgraup · Accepted Answer · 2020-03-11 05:40:13Z

2

Use this to combine them:

{
   "size":0,
   "query":{
      "filtered":{
         "query":{
            "query_string":{
               "query":"+environmentType:prod +application:app1",
               "analyze_wildcard":true
            }
         }
      }
   },
   "aggs":{
      "simpleDatehHistogram":{
         "date_histogram":{
            "field":"timestamp",
            "interval":"day"
         }
      }
   }
}

edited Mar 11, 2020 at 5:40

jgraup

1,30913 silver badges14 bronze badges

answered May 12, 2017 at 8:21

Richa

7,6796 gold badges30 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Acalypha Over a year ago

this was the first thing I tried actually, but the results are identical regardless of the name of my application, so I guess that filter is not applied...

Richa Over a year ago

Can you just post mapping of your index. GET index/type/_mapping

Richa Over a year ago

I just tried above query and it did bring me aggregation buckets on the basis of query applied above. Can you just elaborate more on this .

Acalypha Over a year ago

Okay, I just tried to do an aggregation on my applications only and found out that application names with '-' are not divided as I expected, so with application names 'app_one', and 'app_two', I get three buckets of 'app', 'one', and 'two', and query_string on either one returns the 'app' bucket.

Richa Over a year ago

Happy to help :)

Collectives™ on Stack Overflow

combine query_string and aggregations

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related