Elasticsearch: Aggregations with conditions on both parent and child

Question

I have two indices named "ride" and "audit_log" where audit_log is child of ride. I need to fetch average of timestamp from audit_log table(index) based on some conditions. Conditions span to both parent and child. The query, I am trying to execute is:

curl -XGET 'http://localhost:9200/rides/audit_log/_search' -d

{
   "size":0,
   "query":{
      "has_parent":{
         "parent_type":"ride",
         "query":{
            "match":{
               "ride_status":"Ride Completed"
            }
         }
      },
      "match":{
         "status":"Driver Confirmed"
      }
   },
   "aggs":{
      "avg_time":{
         "avg":{
            "field":"createdAt"
         }
      }
   }
}

here ride_status is from parent table ride.

And, I am getting following error from this api hit:

[has_parent] malformed query, expected [END_OBJECT] but found [FIELD_NAME]","line":1,"col":107

Answer 1

Try using the term instead of match.

{
   "size":0,
   "query":{
      "has_parent":{
         "parent_type":"ride",
         "score" : true, <---- add this
         "query":{
           "term": {
            "ride_status":"Ride Completed"
           }
         }
      },
      "term": {
            "status":"Driver Confirmed"
       }
   },
   "aggs":{
      "avg_time":{
         "avg":{
            "field":"createdAt"
         }
      }
   }
}