0

I have this query which is hitting the below table. How can I add source field to it to return specific columns from the _source field of this index?

GET mktg_percolate_postmetrics_mib/_search

{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "end_date": {
              "gte": "now-30d",
              "lte": "now",
              "format": "epoch_millis"
            }
          }
        }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "2": {
      "terms": {
        "field": "post_id",
        "size": 25,
        "order": {
          "1": "desc"
        }
      },
      "aggs": {
        "1": {
          "sum": {
            "script": "doc['facebook_likes'].value + doc['facebook_shares'].value + doc['facebook_comments'].value + doc['facebook_post_consumptions_by_type_link_clicks'].value",
            "lang": "expression"
          }
        }
      }
    }
  }
}
Chetan Sharma
  • 1,432
  • 12
  • 13
  • 1
    You need to look into [source filtering](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-source-filtering.html) – Val May 16 '17 at 12:49
  • Thanks @Val I was looking into it before. Adding source field doesn't result in anything for me. My query fetch highest engaging post in last 30 days based on the formula in the script tag. – Chetan Sharma May 16 '17 at 12:54
  • Can you show how you have used the `_source` field in your query? Also can you tell in which client you are running your queries? – Val May 16 '17 at 12:55
  • Which ES version are you using?? – Richa May 16 '17 at 12:56
  • "_source": { "includes": [ "facebook_comments" ], "excludes": [ ] } Cant' everything. I added this before query as per the documentation – Chetan Sharma May 16 '17 at 13:02
  • @Richa - Unable to find but my Kibana version is 4.5.4. It's hosted on a client's machine. – Chetan Sharma May 16 '17 at 13:03
  • You can have a look at this answer. It http://stackoverflow.com/a/9605566/4188368 – Richa May 16 '17 at 13:06
  • Thanks Richa. I tried with both _source and fields. I don't see any difference in the three outputs. Without source or field, with _source, and with fields – Chetan Sharma May 16 '17 at 13:11
  • You mean you get all the fields in `hits`. That's kind of strange. – Richa May 16 '17 at 13:47
  • No. I am not getting any. I will post the response here – Chetan Sharma May 16 '17 at 14:17
  • { "took": 3, "timed_out": false, "_shards": { "total": 5, "successful": 5, "failed": 0 }, "hits": { "total": 16979, "max_score": 0, "hits": [] }, "aggregations": { "2": { "doc_count_error_upper_bound": -1, "sum_other_doc_count": 16943, "buckets": [ { "1": { "value": 2804 }, "key": "23817530", "doc_count": 17 }, { "1": { "value": 2098 }, "key": "22923723", "doc_count": 19 }]}}} – Chetan Sharma May 16 '17 at 14:33
  • I can not see any fields in `hits`What I can see over here is `aggregation bucket` response. `Hits` array is empty. – Richa May 16 '17 at 14:58

0 Answers0