0

I am not able to get cardinality of a field from an elasticsearch index. The mapping is as follows: enter image description here

And the query which I am trying to fire is as follows:

--header 'Content-Type: application/json' \
--data-raw '{
        "aggs": {
            "type_count": {
                "cardinality": {
                    "field": "rawLog.keyword"
                }
            }
        }
}'```

but I am getting 0 in result

```{
    "took": 21,
    "timed_out": false,
    "_shards": {
        "total": 3,
        "successful": 3,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 10000,
            "relation": "gte"
        },
        "max_score": null,
        "hits": []
    },
    "aggregations": {
        "type_count": {
            "value": 0
        }
    }
}```
sky
  • 260
  • 3
  • 12
  • 1
    Are you certain that `rawLog.keyword` is at the root of your mapping and not nested into another field? – Val Mar 24 '21 at 07:20
  • No this is the mapping I have got. FYR I am attaching the mapping https://pastebin.com/jWE5vbKV – sky Mar 24 '21 at 10:19

0 Answers0