Getting empty buckets array in elasticsearch aggregation

Question

I'm using version 5.4.1 of ElasticSearch.

When I try to perform a groupBy aggregate/bucket aggregate, I'm not getting any values in the bucket array.

This is my index:

   curl -X PUT localhost:9200/urldata -d '{
    "mappings" : {
        "components" : {
            "properties" : {
                "name" : {
                    "type" : "keyword",
                    "index" : "not_analyzed"
                },
                "status" : {
                    "type" : "keyword",
                    "index" : "not_analyzed"
                },
                "timestamp":{
                    "type":"date",
                    "index":"not_analyzed"
                }
            }
        }
    }
}'

And this the aggregate query:

curl -XGET 'localhost:9200/urldata/_search?pretty' -H 'Content-Type: application/json' -d'
    {
      "size": 0,
      "aggs": {
        "components": {
          "terms": {
            "field": "name.keyword"
          }
        }
      }
    }
    '

Output:

{  
"took":2,
   "timed_out":false,
   "_shards":{  
      "total":5,
      "successful":5,
      "failed":0
   },
   "hits":{  
      "total":3,
      "max_score":0.0,
      "hits":[  

      ]
   },
   "aggregations":{  
      "components":{  
         "doc_count_error_upper_bound":0,
         "sum_other_doc_count":0,
         "buckets":[  

         ]
      }
   }
}

Where am I going wrong??

{name: "A", status: "success", created_at: "2017-08-17" } {name: "A",status: "failure",created_at: "2017-08-18"} — Anant Pathak
– Anant Pathak, Commented Aug 18, 2017 at 3:51

mel · Accepted Answer · 2017-08-18 07:27:39Z

2

Try this, it should do it:

{
  "size": 0,
  "aggs": {
    "components": {
      "terms": {
        "field": "name"
      }
    }
  }
}

EDIT:

Here is all the steps to replicate your use case:

PUT test
{
    "settings" : {
        "index" : {
            "number_of_shards" : 1, 
            "number_of_replicas" : 0
        }
    }
}

PUT test/_mapping/people_name
{  
  "properties":{  
      "name":{  
        "type":"keyword",
        "index":"not_analyzed"
      },
      "status":{  
        "type":"keyword",
        "index":"not_analyzed"
      },
      "timestamp":{  
         "type":"date",
         "index":"not_analyzed"
      }
  }
}

POST test/people_name
{
  "name": "A", 
  "status": "success", 
  "created_at": "2017-08-17"
}

POST test/people_name
{
  "name": "A", 
  "status": "success_2", 
  "created_at": "2017-06-15"
}

POST test/people_name
{
  "name": "B", 
  "status": "success", 
  "created_at": "2017-09-15"
}

GET test/people_name/_search
{
  "size": 0,
  "aggs": {
    "components": {
      "terms": {
        "field": "name"
      }
    }
  }
}

The result of the aggregation is:

{
  "took": 3,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "failed": 0
  },
  "hits": {
    "total": 3,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "components": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "A",
          "doc_count": 2
        },
        {
          "key": "B",
          "doc_count": 1
        }
      ]
    }
  }
}

edited Aug 18, 2017 at 7:27

answered Aug 18, 2017 at 6:02

mel

2,8209 gold badges43 silver badges71 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Anant Pathak Over a year ago

Tried this but it threw the exception: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. . Then I set fielddata=true and now it's working.Can't understand how can ES documentation can be so buggy.Atleast they should have mentioned this issue.

mel Over a year ago

Which exception? Which version are you on?

Anant Pathak Over a year ago

I'm using ES version 5.4.1

mel Over a year ago

So it's good? I just use your mapping. I had no problem going my query.

mel Over a year ago

No. You misunderstood the documentation. They state that you should use name.keyword only if in your mapping nameis a text and you have another field name.keyword of type keyword. The query you write in your question should be name and not name.keyword according to your mapping. On my part I used your mapping and didn't have to set the field data to true. I will update my answer with all the steps

|

Collectives™ on Stack Overflow

Getting empty buckets array in elasticsearch aggregation

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related