ElasticSearch terms aggregation by entire field

Question

How can I write an ElasticSearch term aggregation query that takes into account the entire field value, rather than individual tokens? For example, I would like to aggregate by city name, but the following returns new, york, san and francisco as individual buckets, not new york and san francisco as the buckets as expected.

curl -XPOST "http://localhost:9200/cities/_search" -d'
{
   "size": 0, 
   "aggs" : {
     "cities" : {
         "terms" : { 
            "field" : "city",
            "min_doc_count": 10
         }
     }
   }
}'

Jettro Coenradie · Accepted Answer · 2014-10-31T15:57:13.883

16

You should fix this in your mapping. Add a not_analyzed field. You can create the multi field if you also need the analyzed version.

"album": {
  "city": "string",
  "fields": {
    "raw": {
      "type": "string",
      "index": "not_analyzed"
    }
  }
}

Now create your aggregate on city.raw

edited Oct 31 '14 at 15:57

answered Apr 01 '14 at 22:39

Jettro Coenradie

4,735
23
31

Perfect solution. I don't need the fields analyzed anyway, so I made it a keyword analyzer and it works. – Avishai Apr 02 '14 at 18:44
1

Anyway to do this without fixing the mapping? – Henley Jul 05 '14 at 15:29
Not that I know of Henley Chiu – Jettro Coenradie Jul 05 '14 at 16:33
I tried to go for this solution, but wasnt able to do proper filter queries for the "entire" string – Paul Oct 03 '14 at 13:18
Hi @PaulH, I am curious why it did not work for you. Maybe create a new question with your problem? This should work for filters, did you use the city.raw field? – Jettro Coenradie Oct 31 '14 at 15:58

zhongjiajie · Answer 2 · 2019-03-06T11:30:44.190

6

Update at 2018-02-11 now we can use syntax .keyword after grouped by field according to this

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword"
      }
    }
  }
}

edited Mar 06 '19 at 11:30

answered Feb 11 '18 at 08:23

zhongjiajie

2,098
1
12
18

score 1 · Answer 3 · answered Jun 06 '16 at 06:05

This elastic doc suggests to fix that in mapping (as suggested in the accepted answer) - either to make the field not_analyzed or to add a raw field with not_analyzed and use it in aggregations.

There is no other way for it. As the aggregations operate upon inverted index and if the field is analyzed, the inverted index is bound to have only tokens and not the original values of the field.

ElasticSearch terms aggregation by entire field

3 Answers3

Linked