Multiple field filter when using aggregation in elasticsearch

Question

{
  "query":{
    "constant_score": {
      "filter": {
        "match":{
          "request_1":"rent"
        }
      }
    }
  },
  "aggs": {
    "s": {
      "terms": {
        "field": "serial_number"
      }
    }
  }
}

This is my query which works fine.

I want inside filter.match I want to add another field so that aggregation happens on result returned when two filter has been satisfied.

I am trying to do something like:

{
  "query":{
    "constant_score": {
      "filter": {
        "match":{
          "request_1":"rent",
          "request_2":"check"
        }
      }
    }
  }
}

as suggested I've tried

{
  "query":{
    "constant_score": {
      "filter": [
        {
          "match":{
            "request_1":"rent"
        }
      },
      {
          "match":{
            "request_2":"check"
        }
      }
     ]
    }
  },
  "aggs": {
    "s": {
      "terms": {
        "field": "serial_number"
      }
    }
  }
}

which outputs an error:

{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "unexpected token [START_ARRAY]",
        "line": 4,
        "col": 17
      }
    ],
    "type": "parsing_exception",
    "reason": "unexpected token [START_ARRAY]",
    "line": 4,
    "col": 17
  },
  "status": 400
}

So that I get aggregation from those who only have "rent" in request_1 field and "check" in request_2 field. How can I accomplish this?

Val · Accepted Answer · 2019-11-06 08:19:50Z

1

You need to do it like this:

{
  "query": {
    "bool": {
      "filter": [
        {
          "match": {
            "request_1": "rent"
          }
        },
        {
          "match": {
            "request_2": "check"
          }
        }
      ]
    }
  },
  "aggs": {
    "s": {
      "terms": {
        "field": "serial_number"
      }
    }
  }
}

On very old versions of ES (pre 2.0), you can use this query instead:

{
  "query": {
    "constant_score": {
      "filter": {
        "bool": {
          "must": [
            {
              "match": {
                "request_1": "rent"
              }
            },
            {
              "match": {
                "request_2": "check"
              }
            }
          ]
        }
      }
    }
  },
  "aggs": {
    "s": {
      "terms": {
        "field": "serial_number"
      }
    }
  }
}

edited Nov 6, 2019 at 8:19

answered Nov 6, 2019 at 8:08

Val

218k14 gold badges377 silver badges384 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

haneulkim Over a year ago

I ran exactly same query but give we "parsing_exception" error

haneulkim Over a year ago

changed it in my question

Val Over a year ago

Which version of ES are you using?

haneulkim Over a year ago

I am using 7.1 and in AWS

Val Over a year ago

Your query is not exactly like mine. Check mine again and compare it with yours, you'll see that both match queries are not located inside the filter array. You're missing an opening curly brace on the first match query.

|

Collectives™ on Stack Overflow

Multiple field filter when using aggregation in elasticsearch

1 Answer 1

7 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Related