Here is some sample data:
PUT index1
PUT index1/type1/_mapping
{
"type1": {
"properties": {
"kvp": {
"type": "nested",
"properties": {
"key": {
"type": "string"
},
"value": {
"type": "string"
}
}
}
}
}
}
POST index1/type1
{
"kvp": [
{
"key": "key1",
"value": "value1"
}
]
}
POST index1/type1
{
"kvp": [
{
"key": "key1",
"value": "value1"
},
{
"key": "key1",
"value": "value2"
},
{
"key": "key2",
"value": "value1"
},
{
"key": "key2",
"value": "value2"
}
]
}
The result I'd like combines the fields "kvp.key" and "kvp.value":
key1 - value1: DocCount = 2
key1 - value2: DocCount = 1
key2 - value2: DocCount = 1
I'm starting to think that I need to re-index the data and combine the
"kvp.key" and "kvp.value" fields into a single field so that I can
aggregate on it.
On Friday, October 24, 2014 2:17:04 PM UTC-5, Jay Hilden wrote:
>
> I have an ES type with a nested KeyValuePair type. What I'm trying to do
> is a terms aggregation on both the key and value fields such that I'd get
> the following results:
>
> Key1 - Value1: DocCount = 10
> Key1 - Value2: DocCount = 9
> Key2 - Value3: DocCount = 4
>
> Here is my mapping:
> {
> "index123" : {
> "mappings" : {
> "type123" : {
> "properties" : {
> "authEventID" : {
> "type" : "long"
> },
> "authInput" : {
> "properties" : {
> "uIDExtensionFields" : {
> "type" : "nested",
> "properties" : {
> "key" : {
> "type" : "string"
> },
> "value" : {
> "type" : "string"
> }
> }
> }
> }
> }
> }
> }
> }
> }
> }
>
> Is there a way to do this?
>
> Thank you.
>
--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/d9db4ea8-68af-4cc5-a6dc-876f218b58f7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
