Json Question posted in
Our archive of expertly curated questions and answers provides insights and solutions to common problems related to this popular data interchange format. From parsing and manipulating JSON data to integrating it with various programming languages and web services, our archive has got you covered. Start exploring today and take your JSON skills to the next level

Json – Elasticsearch aggregation with .keyword does not returns the results

I have an Elasticsearch index, part of its mapping is as follows:

...
},
                "entity": {
                    "properties": {
                        "DateTime": {
                            "type": "date"
                        },
                        "Event": {
                            "type": "keyword"
                        },
                        "Location": {
                            "type": "keyword"
                        },
                        "Organ": {
                            "type": "keyword"
                        },
                        "Person": {
                            "type": "keyword"
                        }
                    }
                },
...

I want to find the most frequent person. So, I query the index in the following ways:

{"size":0, "query":{"match_all":{}},"aggs":{"top_locations":{"terms":{"field":"entity.Person","size":1}}}}

and

{"size":0, "query":{"match_all":{}},"aggs":{"top_locations":{"terms":{"field":"entity.Person.keyword","size":1}}}}

The problem is that the first query works fine, but the second does not work.

Tags:

3

Answers


  1. 0

    You can try this

    {
  "size": 0,
  "query": {
    "match_all": {}
  },
  "aggs": {
    "nested_entity": {
      "nested": {
        "path": "entity"
      },
      "aggs": {
        "top_people": {
          "terms": {
            "field": "entity.Person.keyword",
            "size": 1
          }
        }
      }
    }
  }
}
    Login or Signup to reply.
  2. 0

    The first query will work yes and the second will not as you have observed already.

    The reason is that the .keyword subfield does not exist.

    If your mapping was like:

                "entity": {
                "properties": {
                    ...
                    "Person": {
                        "type": "keyword",
                        "fields": {
                            "keyword": {
                                "type": "keyword"
                            }
                        }
                    }
                }
            },

    then the second query would work too.

    But you shouldn’t want to do this because your "main" field is already type keyword. Subfields are usually used when the main type is something else. Like:

                "entity": {
                "properties": {
                    ...
                    "Person": {
                        "type": "text",
                        "fields": {
                            "keyword": {
                                "type": "keyword"
                            }
                        }
                    }
                }
            },

    In which case Person is type text and Person.keyword is type keyword.

    Please also note that the name of the subfield could be anything you like.

                "entity": {
                "properties": {
                    ...
                    "Person": {
                        "type": "text",
                        "fields": {
                            "foobar": {
                                "type": "keyword"
                            }
                        }
                    }
                }
            },

    So in the above example Person.keyword would not work because we would need to use Person.foobar

    It’s just that we usually give the same name as the type of the subfield.

    Login or Signup to reply.
  3. 0

    Your first query works fine because entity.Person field exist. The second query is not exist because entity.Person.keyword field is not exist.

    The field name does not have to be .keyword just because the field type is ‘keyword’.

    You can check if the field exist with the following API call.

    GET your_index_name/_mapping/field/your_field_name
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search