Elasticsearch aggregation return null values as 0?

Question

I can count the hits per day that match my queried string with this code, but if the span of a whole week has no hits, then the query will return nothing - as opposed to returning 0 for each day. Is there a way I can 'default' to 0?

GET index/_search
    {
  "size": 0,
  "query": {
    "bool": {
      "must": [
          {"match_phrase": {
            "message": "Cannot login"
            }
          },
          {"range": {
            "@timestamp":{
              "gte":"2021-07-01",
              "lte":"2021-07-07"
            }
          }
        }
      ]
    }
  }, 
  "aggs": {
    "hit_count_per_day": {
      "date_histogram": {
        "field": "@timestamp",
        "calendar_interval": "day"
      }
    }
  } 
}

Saeed Nasehi · Accepted Answer · 2021-08-24 18:43:10Z

2

For this propose you need to add extended_bounds to your aggregation like below:

GET index/_search
    {
  "size": 0,
  "query": {
    "bool": {
      "must": [
          {"match_phrase": {
            "message": "Cannot login"
            }
          },
          {"range": {
            "@timestamp":{
              "gte":"2021-07-01",
              "lte":"2021-07-07"
            }
          }
        }
      ]
    }
  }, 
  "aggs": {
    "hit_count_per_day": {
      "date_histogram": {
        "field": "@timestamp",
        "calendar_interval": "day",
        "extended_bounds": {
          "min": "2021-07-01",
          "max": "2021-07-07"
        }
      }
    }
  } 
}

Please let me know if it did not solve your problem.

answered Aug 24, 2021 at 18:43

Saeed Nasehi

1,0001 gold badge14 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

HC LW Over a year ago

Yes friend! It does work, thanks for helping again

Saeed Nasehi Over a year ago

You're welcome, buddy. Glad to hear that.

Alex · Accepted Answer · 2022-10-10 13:53:14Z

0

When elasticsearch in aggregation response returns 0s means there are values not showed because of filters.

For example, I had a term filter on "region":"mexico" and it returned me:

"colombia": 0
"argentina": 0
"mexico": 7

Firsts two because of they are in dataset (index) but filtered.

Hopin' it could help.

edited Oct 10, 2022 at 13:53

answered Oct 10, 2022 at 13:51

Alex

112 bronze badges

Collectives™ on Stack Overflow

Elasticsearch aggregation return null values as 0?

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related