Elasticsearch- get all values for a given field?

Question

Is it possible to query for all of the values a specific field? Say I have "articles" and each article has an author, is there a query I can perform to find a list of all authors?

Answer 1

How to get all possible values for field author?

curl -XGET  http://localhost:9200/articles/_search?pretty -d '
{
    "aggs" : {
        "whatever_you_like_here" : {
            "terms" : { "field" : "author", "size":10000 }
        }
    },
    "size" : 0
}'

Note

• "size":10000 Get at most 10000 unique values. Default is 10.

• "size":0 By default, "hits" contains 10 documents. We don't need them.

• By default, the buckets are ordered by the doc_count in decreasing order.

---

Reference: bucket terms aggregation

Also note, according to this page, facets have been replaced by aggregations in Elasticsearch 1.0, which are a superset of facets.

Answer 2

I think what you want is a faceted search. Have a look at this example from the documentation:

http://www.elasticsearch.org/guide/reference/api/search/facets/index.html

curl -X POST "http://localhost:9200/articles/_search?pretty=true" -d '
  {
    "query" : { "query_string" : {"query" : "*"} },
    "facets" : {
      "tags" : { "terms" : {"field" : "author"} }
    }
  }
'

See if you can tailor this to work for you.

Answer 3

another example

request

curl -X POST "http://localhost:9200/_search?pretty=true" -d '
{
  "facets" : {
    "tags" : { "terms" : {"field" : "network.platform"} },
    "size" : 60
  },
  "size" : 0
}
'

response

{
  "took" : 266,
  "timed_out" : false,
  "_shards" : {
    "total" : 650,
    "successful" : 650,
    "failed" : 0
  },
  "hits" : {
    "total" : 41,
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "facets" : {
    "tags" : {
      "_type" : "terms",
      "missing" : 15,
      "total" : 26,
      "other" : 0,
      "terms" : [ {
        "term" : "platform name 1",
        "count" : 20
      }, {
        "term" : "platform name 2",
        "count" : 6
      } ]
    }
  }
}

Answer 4

I think the optimal way is to use elasticsearch aggregation https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html

GET {index}/{type}/_search
{
  "size": 0, <-- to not display search hits
  "aggs": {
    "{aggregation_name}": {
      "terms": {
        "field": "{filed_value}",
        "size": 10
      }
    }
  }
}

Answer 5

You don't mention the Elasticsearch Version, but for ES 1.6, the preferred method is using aggregations. Here is an example of what I use.

--Get all the STATUS values, which is a nested query.

GET path for data/_search?size=200
{
  "aggs": {
    "something": {
      "nested": {
        "path": "NESTED_PATH"
      },
      "aggs": {
        "somethingCodes": {
          "terms": {
            "field": "NESTED_PATH.STATUS",
            "size": 50
          }
        }
      }
    }
  }
}

and an example Response:

"aggregations": {
      "panels": {
         "doc_count": 5029693,
         "panelCodes": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
               {
                  "key": "M",
                  "doc_count": 1943107
               },
               {
                  "key": "W",
                  "doc_count": 137904
               },
               {
                  "key": "E",
                  "doc_count": 69080
               },
               {
                  "key": "Y",
                  "doc_count": 4081
               },
               {
                  "key": "N",
                  "doc_count": 1063
               },
               {
                  "key": "T",
                  "doc_count": 483
               },
               {
                  "key": "",
                  "doc_count": 1
               }
            ]
         }
      }
   }

Answer 6

Fastest way of checking existing field values:

GET myindex/mytype/<id>/_termvectors?fields=Product.Material.Code

• myindex = index
• mytype = type
• <id> = document id

Answer 7

Please use the below code to get only list of 'articles' field values from all the content in the index.

curl 'http://localhost:9200/my_index/_search?pretty=true&_source=articles'

It will sure help you.