How to aggregate on a matched prefix/phrase from ElasticSearch records?

Question

I have a field "Departments" which is a list: { "Departments": ["Food Service","Software Development","Manufacturing","Deployment"] }'

I want to aggregate on the elements of "Department" that start with "d". i.e., Deployment from all records.

I am able to find the records that have one element with prefix "d" but not able to aggregate over them. Rather I am aggregating over all the elements of "Departments" in the records returned after querying for the prefix "d".

{
 "query": {
        "bool": {
            "filter": {
                "match_phrase_prefix": {
                    "Departments": {"query": "a"}
                }
            }
        }
    },
    "aggs" : {
        "all_locations" : {
            "terms" : { "field" : "Departments" }
        }
    }
}

For example, if I have 4 records in total, out of which "Deployment" is present in 1, then I want:

Deployment:1

But what I am actually getting is the frequency of all the elements in that record where "Deployment" is present.

Deployment:1, Food:1, Services:1, Software:1, Development:1, Manufacturing:1

Kamal Kunjapur · Accepted Answer · 2019-04-19T23:42:42.830

3

That's easy. Just make use of include keyword and add the required regex value to it, in the Terms Query and you'd get what you want.

I've mentioned the solution below:

POST <your_index_name>/_search
{  
   "query":{  
      "bool":{  
         "filter":{  
            "match_phrase_prefix":{  
               "Departments":{  
                  "query":"a"
               }
            }
         }
      }
   },
   "aggs":{  
      "all_locations":{  
         "terms":{  
            "field":"Departments",
            "include":"D.*"
         }
      }
   }
}

The above query would only return aggregation buckets starting with D. You can change it to Dep.* to test for Deployment

Feel free to accept/upvote the answer if you think it resolved your requirement. Queries are most welcome.

edited Apr 19 '19 at 23:42

answered Apr 19 '19 at 23:32

Kamal Kunjapur

8,547
2
22
32

2

Hey! The more I work with ElasticSearch, I find something new about ElasticSearch. Is there something comprehensive, be it a book or article, that I can teach me different scenarios with ElasticSearch? – Shruti Kar May 19 '19 at 22:50
1

@ShrutiKar I haven't followed any book. Elasticsearch references are vastly under-rated. Follow the APIs, original manuals/specifications/reference docs of the author/source/technology (yes, get rid of habit of finding answers/code from google, if you can, well I'm also failing at that lately). Start reading some of the blogs published in Elasticsearch site itself, they are great articles. – Kamal Kunjapur May 19 '19 at 23:09
1

It takes huge effort and time to master one technology possibly years, so try to have a little patience. You would need time to digest what you'd consume, so try to spend sometime on each of the topics. Best way I can say is, focus on abstractions on what ES or any technology can do best. For e.g. with elasticsearch 1. Basic searching(Includes concept of ranking, influencing scoring) 2. Aggregation. Then there is another part 3. Ingestion of documents 4. Monitoring clusters/nodes. And one thing that helped me, is start contributing to SOF. It would enhance your learning curve. Good luck!! – Kamal Kunjapur May 19 '19 at 23:13

How to aggregate on a matched prefix/phrase from ElasticSearch records?

1 Answers1