Elasticsearch Aggregation on array of single objects

Question

My query search result is of following structure

[   
     {
        "_index" : "xxxx",
        "_type" : "status",
        "_id" : "01xxxxxxxxxxx",
        "_score" : 6.297049,
        "_source" : {
          "messageDetail" : {
            "errors" : [
              {
                "errorMessage" : ".metaData should have required property 'schemaVersion'"
              }
            ]
          }
        }
      },
      {
        "_index" : "xxxx",
        "_type" : "status",
        "_id" : "076XXXXxxx",
        "_score" : 6.297049,
        "_source" : {
          "messageDetail" : {
            "errors" : [
              {
                "errorMessage" : ".metaData should have required property 'scenarioName'"
              }
            ]
          }
        }
      },
...]

I would like to aggregate over messageDetail.errors.errorMessage and create a map alike structure that will hold the different error messages and their number of occurrence in a key-value pair.

P.S. - messageDetail.error is an array of single object.

Can someone please provide any query for the same.

Bhavya · Accepted Answer · 2020-10-06 18:03:53Z

1

Adding a working example with index data (used same as that given in question), index mapping, search query, and search result

Index Mapping:

{
  "mappings": {
    "properties": {
      "messageDetail": {
        "properties": {
          "errors": {
            "properties": {
              "errorMessage": {
                "type": "keyword"
              }
            }
          }
        }
      }
    }
  }
}

Search Query

{
    "size": 0, 
    "aggs" : {
        "states" : {
            "terms" : { 
                "field" : "messageDetail.errors.errorMessage"
            }
        }
    }
}

Search Result:

"aggregations": {
    "states": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": ".metaData should have required property 'scenarioName'",
          "doc_count": 1
        },
        {
          "key": ".metaData should have required property 'schemaVersion'",
          "doc_count": 1
        }
      ]
    }

answered Oct 6, 2020 at 18:03

Bhavya

16.2k3 gold badges23 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

banerjeesouvik Over a year ago

Thanks for answering. Can you please suggest if I don't have control over the mapping?

Bhavya Over a year ago

@banerjeesouvik thanks for your reply. It would be great if you can share your index mapping (which you are using), only then I can comment if the above results can be achieved using your mapping or not :)

banerjeesouvik Over a year ago

thanks for your answer. the requirement got changed, so I did not follow up on this anymore. thanks again for your help.

Bhavya Over a year ago

@banerjeesouvik no problem :) Can you please accept my answer as well (if it helped you resolve your previous requirement)

Bhavya Over a year ago

Thank u @banerjeesouvik for accepting my answer 🙂 Hope you have upvoted my answer as well 🙂

Collectives™ on Stack Overflow

Elasticsearch Aggregation on array of single objects

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related