Good question :)
In order to get what you want you should define your mapping upfront and nested property mapping works well.
The nested type is a specialized version of the object datatype that allows arrays of objects to be indexed and queried independently of each other.
https://www.elastic.co/guide/en/elasticsearch/reference/2.4/nested.html
Please find below full example :)
Mapping
PUT example_nested_test
{
"mappings": {
"nested": {
"properties": {
"Id": {
"type": "long"
},
"Services": {
"type": "nested",
"properties": {
"Id": {
"type": "long"
},
"Date": {
"type": "date"
},
"Rating": {
"type": "long"
}
}
}
}
}
}
}
POST Data
POST example_nested_test/nested/100
{
"Id" : 1,
"Services": [
{
"Id": 1,
"Date" :"2017-05-10",
"Rating" : 5
},
{
"Id": 2,
"Date" :"2013-05-10",
"Rating" : 2
},
{
"Id": 4,
"Date" :"2017-05-10",
"Rating" : 6
}]
}
Query
GET example_nested_test/_search
{
"size":0,
"aggs": {
"Services": {
"nested": {
"path": "Services"
},
"aggs": {
"Rating": {
"filter": {
"bool": {
"must": [
{
"range": {
"Services.Date": {
"gt": "2017",
"format": "yyyy"
}
}
},
{
"range": {
"Services.Rating": {
"gt": "5"
}
}
}
]
}
}
}
}
}
}
}
Result :
"aggregations": {
"Services": {
"doc_count": 3,
"Rating": {
"doc_count": 1
}
}
}