0

I wrote a elasticsearch query to get the aggregated doc count of a matching keyword "webserver1". Below is the query:

POST _search?filter_path=aggregations.*.buckets
{
  
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "hostname": "webserver1"
          }
        }
      ]
    }
  },
  "aggs": {
    "webserver1": {
      "terms": {
        "field": "webserver1"
      }
    }
  }
}

Response:

{
  "aggregations" : {
    "webserver1" : {
      "buckets" : [
        {
          "key" : "webserver1",
          "doc_count" : 36715
        }
      ]
    }
  }
}

Is there a way to filter only the wanted text and display it like the below one:

{
    "webserver1" : 36715
}

I have checked multiple resource but I'm not able to find any filters/options to do it.

Ersoy
  • 8,816
  • 6
  • 34
  • 48
Arjun Kr
  • 3
  • 1
  • No you cannot change the format of the JSON in the response, but you can format the data on the client side as you wish – Val Jun 23 '20 at 14:17
  • @Val Shouldn't your statement be an answer? – Gibbs Jun 23 '20 at 14:51
  • The best you can do is to filter out unneeded fields from the response, see this thread: https://stackoverflow.com/questions/33481977/elasticsearch-remove-default-fields-from-searchs-response-body/33482067#33482067 – Val Jun 23 '20 at 14:55
  • @Val I already applied filter_path. I wanted to format the JSON response. – Arjun Kr Jun 24 '20 at 06:03
  • Then I would suggest using [jq](https://stedolan.github.io/jq/) to transform the output the way you like – Val Jun 24 '20 at 06:05

0 Answers0