Elasticsearch aggregations: how to get bucket with 'other' results of terms aggregation?

0
votes

I use aggregation to collect data from nested field and stuck a little

Example of document:

{
  ...
  rectangle: {
    attributes: [
      {_id: 'some_id', ...}
    ]
}

ES allows group data by rectangle.attributes._id, but is there any way to get some 'other' bucket to put there documents that were not added to any of groups? Or maybe there is a way to create query to create bucket for documents by {"rectangle.attributes._id": {$ne: "{currentDoc}.rectangle.attributes._id"}} I think bucket would be perfect because i need to do further aggregations with 'other' docs. Or maybe there's some cool workaround

I use query like this for aggregation

"aggs": {
  "attributes": {
    "nested": {
      "path": "rectangle.attributes"
    },
    "aggs": {
      "attributesCount": {
        "cardinality": {
          "field": "rectangle.attributes._id.keyword"
        }
      },
      "entries": {
        "terms": {
          "field": "rectangle.attributes._id.keyword"
        }
      }
    }
  }
}

And get this result

"buckets" : [
  {
    "key" : "some_parent_id",
    "doc_count" : 27616,
    "attributes" : {
      "doc_count" : 45,
      "entries" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : "some_id",
            "doc_count" : 45,
            "attributeOptionsCount" : {
              "value" : 2
            }
          }
        ]
      }
    }
  }
]

result like this would be perfect:

"buckets" : [
  {
    "key" : "some_parent_id",
    "doc_count" : 1000,
    "attributes" : {
      "doc_count" : 145,
      "entries" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : "some_id",
            "doc_count" : 45
          },
          {
            "key" : "other",
            "doc_count" : 100
          }
        ]
      }
    }
  }
]
1
elasticsearchelasticsearch-aggregation

1 Answers

0
votes

You can make use of missing value parameter. Update aggregation as below:

"aggs": {
  "attributes": {
    "nested": {
      "path": "rectangle.attributes"
    },
    "aggs": {
      "attributesCount": {
        "cardinality": {
          "field": "rectangle.attributes._id.keyword"
        }
      },
      "entries": {
        "terms": {
          "field": "rectangle.attributes._id.keyword",
          "missing": "other"
        }
      }
    }
  }
}