2

In my query, I aggregate the buckets in one scalar. Since I'm not interested in each bucket (which, in my case, are tens of millions), I'd like to remove them from the returned result; i.e. I want to do something like "size":0 to hide all the hits. Is it possible?

E.g.:

{
  "size": 0,
  "aggs": {
    "pop": {
      "terms": {
        "field": "account_number",
        "size": 0
      },
      "aggs": { 
            "average": { 
               "avg": {
                  "field": "price" 
               }
            }
         }
    },
    "sum_of_avg": {
      "sum_bucket": {
        "buckets_path": "pop>average"
      }
    }
  }
}

Result:

[...]
"aggregations": {
    "pop": {
      "doc_count_error_upper_bound": 40851,
      "sum_other_doc_count": 93441329,
      "buckets": [...] <== i don't want this
    },
    "sum_of_avg": {
      "value": 128.0768325884469
    }
bcl
  • 147
  • 4
  • 15
  • This is related to this question: [link](http://stackoverflow.com/questions/38081739/how-to-perform-a-pipeline-aggregation-without-returning-all-buckets-in-elasticse) – bcl Sep 05 '16 at 08:59

2 Answers2

3

I just posted an answer in the related question.

In this case the request should look like this:

curl -XPOST 'http://localhost:9200/<index>/_search?filter_path=aggregations.sum_of_avg' -d '
{
  "size": 0,
  "aggs": {
    "pop": {
      "terms": {
        "field": "account_number",
        "size": 0
      },
      "aggs": { 
            "average": { 
               "avg": {
                  "field": "price" 
               }
            }
         }
    },
    "sum_of_avg": {
      "sum_bucket": {
        "buckets_path": "pop>average"
      }
    }
  }
}

PS: if you found another solution, please share it here. Thanks!

Community
  • 1
  • 1
fgal
  • 261
  • 3
  • 6
-2

I think what you want is the "Cardinality" Aggregation. That will return to you the number of distinct values.

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-cardinality-aggregation.html

Example:

GET devdev/alert/_search
{
  "size": 0,
  "aggs": {
    "agg1": {
      "cardinality": {
        "field": "price"
      }
    }
  }
}
jhilden
  • 12,207
  • 5
  • 53
  • 76
  • Not really, for each bucket I want to apply an aggregate function and then sum all the results up, just like in my example. :) – bcl Sep 02 '16 at 07:51