0

This is an extension of this question. The query I'm using, like this is supposed to count the number of entries per hour.

GET index_with_text/_search
{
  "size": 0,
  "query": {
    "range": {
      "timestamp": {
        "gte": "2021-06-15",
        "lte": "now"
      }
    }
  }, 
  "aggs": {
    "hit_count_per_day": {
      "date_histogram": {
        "field": "timestamp",
        "calendar_interval": "hour"
      }
    }
  }
}

However I'm getting this...

"error" : {
"root_cause" : [
  {
    "type" : "illegal_argument_exception",
    "reason" : "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [timestamp] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
  },
HC LW
  • 131
  • 11

1 Answers1

1

Based on the error you are getting, it seems that hit_count_per_day is of text type.

You cannot perform aggregations on fields that are of only text type. To perform date_histogram aggregation, you need to modify your index mapping and then reindex the data.

You need to create a new index with the below index mapping, and then reindex the data in the new index

{
  "mappings": {
    "properties": {
      "timestamp": {
        "type": "date"
      }
    }
  }
}
ESCoder
  • 15,431
  • 2
  • 19
  • 42