Using an aggregation on data with forward slash in elasticsearch

Question

I have data, that has an attribute like this

apiUrl:/REST/endpoint/123

Now I would like to show all the urls and I am trying to use an aggregate function (apiUrl.raw is not_analyzed part of the multifield):

POST /index/type/_search
{
  "aggregations": {
    "application": {
      "terms": {
        "field": "apiUrl.raw"
      }
    }
  }
}

When running this query, no results get returned. What am I doing wrong? I would expect something along the lines (and the count of occurence):

/REST/api1/123
/REST/otherApi/345

Thanks!

score 1 · Accepted Answer · answered May 06 '15 at 22:19

Your query does return non-empty results. Compare and let us know what was the difference:

PUT index
PUT index/type/_mapping
{
  "properties" : {
    "apiUrl": {
      "type": "multi_field",
      "fields": {
        "apiUrl": {"type":"string", "index":"analyzed"},
        "raw": {"type":"string", "index":"not_analyzed"}
      }
    }
  }
}
GET index/type/_mapping
PUT index/type/1
{
  "apiUrl":"/REST/api1/123"
}
PUT index/type/2
{
  "apiUrl":"/REST/otherApi/345"
}
GET index/type/_search?fields=apiUrl.raw
GET index/type/_search
{
  "aggregations": {
    "application": {
      "terms": {
        "field": "apiUrl.raw"
      }
    }
  }
}

Response:

{
   "took": 76,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 2,
      "max_score": 1,
      "hits": [
         {
            "_index": "index",
            "_type": "type",
            "_id": "1",
            "_score": 1,
            "_source": {
               "apiUrl": "/REST/api1/123"
            }
         },
         {
            "_index": "index",
            "_type": "type",
            "_id": "2",
            "_score": 1,
            "_source": {
               "apiUrl": "/REST/otherApi/345"
            }
         }
      ]
   },
   "aggregations": {
      "application": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": [
            {
               "key": "/REST/api1/123",
               "doc_count": 1
            },
            {
               "key": "/REST/otherApi/345",
               "doc_count": 1
            }
         ]
      }
   }
}

You are right, it works. The reason why it didn't work for me is that I ran the mapping update to add the raw field after I've inserted the data to the index, therefore there was nothing to aggregate. Thank you for the answer and time! — Robert Varga, May 06 '15 at 23:28

Using an aggregation on data with forward slash in elasticsearch

1 Answers1