Conditional path in nested aggregation Elasticsearch

Question

I have a nested field with two properties:

{
    "rating": 2
    "victim": [{
        "ip":  "...",
        "instanceId": "....""
    }]
}

I want to aggregate over the rating and get the IP or InstanceId for each document, not both in the bucket list.

What i've got so far is:

"__rating": {
    "terms": {"field": "rating"},
    "aggs": {
        "__hosts": {
            "nested": {"path": "victim"},
            "aggs": {
                "ips": {"terms": {"field": "victim.ip"} } ,
                "instances": {"terms": {"field": "victim.instanceId"} }
            }
        }
    }
}

Above aggregation gets me the buckets for both fields but i need one or other.

Thanks.

Mikail · Accepted Answer · 2018-02-27 21:44:31Z

0

You need to use source filtering in elasticsearch. Add this piece of code in the top of your query:

"_source": {
  "includes": [ "victim.ip"]
}

If you want more detail about source filtering, you should check this out.

answered Feb 27, 2018 at 21:44

Mikail

632 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

John Diaz · Accepted Answer · 2018-02-28 14:28:00Z

0

After a lot of searching, i found the way to do it via painless script:

"terms" : {
    "script" : {
        "source": "doc['victim.instanceId'].value == null ? doc['victim.ip'] : doc['victim.instanceId']",
        "lang": "painless"
    },
    "missing": "N/A"
}

answered Feb 28, 2018 at 14:28

John Diaz

3613 silver badges13 bronze badges

Collectives™ on Stack Overflow

Conditional path in nested aggregation Elasticsearch

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related