Count of unique aggregration doc_count in ElasticSearch

Question

Using ElasticSearch 7.0, I can get how many log I have for each user with an aggregation :

"aggs": {
    "by_user": {
        "terms": {
            "field": "user_id",
        }
    }
}

This returns me something like:

user32: 25
user52: 20
user10: 20
...

What I would like is to know how many user have 25 logs, and how many user have 20 logs etc. The ideal result would be something like :

Because 54 users have 12 logs lines.

How can I make an aggregation that returns this result ?

I´ll would go with this as a sub aggregation elastic.co/guide/en/elasticsearch/reference/current/… — ibexit
– ibexit, Commented May 22, 2019 at 14:07

Andrey Borisko · Accepted Answer · 2019-05-22 21:46:43Z

2

It sounds like you can use Bucket Script Aggregation to simplify your query but the problem is that there is still open PR on this topic.

So, for now i think the simplest is to use painless script with Scripted Metric Aggregation. I recommend you to carefully read about the stages of its execution.

In terms of code I know it's not the best algorithm for your problem but quick and dirty your query could look something like this:

GET my_index/_search
{
  "size": 0, 
    "query" : {
        "match_all" : {}
    },
    "aggs": {
        "profit": {
            "scripted_metric": {
                "init_script" : "state.transactions = [:];", 
                "map_script" :
                """
                def key = doc['firstName.keyword'];
                if (key != null && key.value != null) {
                  def value = state.transactions[key.value];
                  if(value==null) value = 0;
                  state.transactions[key.value] = value+1
                }
                """,
                "combine_script" : "return state.transactions",
                "reduce_script" : 
                """
                def result = [:];
                for (state in states) {
                  for (item in state.entrySet()) {
                    def key=item.getValue().toString();
                    def value = result[key];
                    if(value==null)value = 0;
                    result[key]=value+1;
                  }
                } 
                return result;
                """
            }
        }
    }
}

answered May 22, 2019 at 21:46

Andrey Borisko

4,6193 gold badges24 silver badges32 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Kamal Kunjapur Over a year ago

I really doubt if this is possible using bucket script aggregation. The one you've proposed seems to be the only way to achieve it! Brilliant solution though!!

Collectives™ on Stack Overflow

Count of unique aggregration doc_count in ElasticSearch

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related