ElasticSearch: Concatenate elements of arrays during aggregation

Question

A simple exemple of my data:

    {
        "email" : "user@mail.com",
        "error_codes" : ["12.03","23.22","44.45"]
    }

    {
        "email" : "user@mail.com",
        "error_codes" : ["34.2","23.22","44.45"]
    }

I would like to have a return like this:

    {...
        "aggregations":{
            "buckets" : [
                {
                    "key" : "user@mail.com",
                    "concat_array": {
                        "value":{
                            ["12.03","23.22","44.45","34.2","23.22","44.45"]
                        }
                    }
                }
            ]
        }
    }

I know how to perform aggregation by email and sum simple values, but I can't find the way to concatenate arrays like the result above, as simple as it seems. Is it even possible ? Thank you :)

score 1 · Accepted Answer · edited Jan 20 '22 at 09:44

I don't think this is possible.

Just wondering, this use case seems kind of strange to me. Why would you save something in this format? If you want to save the error code and the user perhaps maybe save each one of them as a document? You need to ask yourself which questions you might want to answer later on. From what I am seeing here a common one would be to know how many responses were there for each error code. Another question might be how many errors did each user receive and all of these questions can be answered by putting each error log into a separate document.

I think this would work best for your case.

ElasticSearch: Concatenate elements of arrays during aggregation

1 Answers1