Understanding Aggregation results on ElasticSearch
I am working on a specific query in ElasticSearch. The goal of the query is to return all the unique results with latest timestamps.
So just to give the background, in the elasticsearch DB, there can be mulitple entries for each of these unique field "x" with different timestamps. I want the ES query to return the latest timestamps for each of these unique field x.
So data looks like in the ES database:
{"x" : "1", "time": 1536574915}
{"x" : "2", "time": 1536574919}
{"x" : "1", "time": 1536574815}
{"x" : "2", "time": 1536574819}
{"x" : "3", "time": 1536574915}
{"x" : "4", "time": 1536574915}
Expected output is
{"x" : "1", "time": 1536574915}
{"x" : "2", "time": 1536574919}
{"x" : "3", "time": 1536574915}
{"x" : "4", "time": 1536574915}
The query I am currently using is:
{
"size": 0,
"query": {
"bool": {
"must": ,
"filter": {
"range": {
"time": {
"lte": "2019-11-16", Can give epoch conversion here
"format": "date_optional_time"
}
}
}
}
},
"aggs": {
"group_by": {
"terms": {
"field": "x"
},
"aggs": {
"resource": {
"terms": {
"field": "time",
"size": 1,
"order": {
"_key": "desc"
}
},
"aggs": {
"include_source": {
"top_hits": {
"from": 0,
"size": 1,
"_source": {}
}
}
}
}
}
}
}
}
The results that get returned on above query have
[
{
"_scroll_id": "DnF1ZXJ5VGhlbkZldGNoAgAAAAAAAAECFmtnNUY4dHFKUXVldXdQMkNSaE1femcAAAAAAAABAxZrZzVGOHRxSlF1ZXV3UDJDUmhNX3pn",
"took": 227,
"timed_out": false,
"_shards": {
"total": 2,
"successful": 2,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 343533,
"max_score": 0.0,
"hits": [
{
}
]
},
"aggregations": {
"group_by": {
"doc_count_error_upper_bound": 4,
"sum_other_doc_count": 343513,
"buckets": [
{ # here is the actual data.
}
]
}
}
},
{
#another scroll_id. Removed the data as its huge.
}
]
My question is, where are the unique results present in the above case?
is it within [hits][hits] or are they within "aggregation"? if within aggregation, for a million records, aggregation is returning me only 10 results. and If I depend on [hits][hits] from each scroll list, then the results are repetitive. I am trying to understand, which part of this result can I get the correct unique entries based on my above query constraint. Or is the query incorrectly formed or missing some parameter.
Appreciate any help.
Thanks.
elasticsearch
asked Nov 16 '18 at 0:33
RM02RM02
1
add a comment |
I am working on a specific query in ElasticSearch. The goal of the query is to return all the unique results with latest timestamps.
So just to give the background, in the elasticsearch DB, there can be mulitple entries for each of these unique field "x" with different timestamps. I want the ES query to return the latest timestamps for each of these unique field x.
So data looks like in the ES database:
{"x" : "1", "time": 1536574915}
{"x" : "2", "time": 1536574919}
{"x" : "1", "time": 1536574815}
{"x" : "2", "time": 1536574819}
{"x" : "3", "time": 1536574915}
{"x" : "4", "time": 1536574915}
Expected output is
{"x" : "1", "time": 1536574915}
{"x" : "2", "time": 1536574919}
{"x" : "3", "time": 1536574915}
{"x" : "4", "time": 1536574915}
The query I am currently using is:
{
"size": 0,
"query": {
"bool": {
"must": ,
"filter": {
"range": {
"time": {
"lte": "2019-11-16", Can give epoch conversion here
"format": "date_optional_time"
}
}
}
}
},
"aggs": {
"group_by": {
"terms": {
"field": "x"
},
"aggs": {
"resource": {
"terms": {
"field": "time",
"size": 1,
"order": {
"_key": "desc"
}
},
"aggs": {
"include_source": {
"top_hits": {
"from": 0,
"size": 1,
"_source": {}
}
}
}
}
}
}
}
}
The results that get returned on above query have
[
{
"_scroll_id": "DnF1ZXJ5VGhlbkZldGNoAgAAAAAAAAECFmtnNUY4dHFKUXVldXdQMkNSaE1femcAAAAAAAABAxZrZzVGOHRxSlF1ZXV3UDJDUmhNX3pn",
"took": 227,
"timed_out": false,
"_shards": {
"total": 2,
"successful": 2,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 343533,
"max_score": 0.0,
"hits": [
{
}
]
},
"aggregations": {
"group_by": {
"doc_count_error_upper_bound": 4,
"sum_other_doc_count": 343513,
"buckets": [
{ # here is the actual data.
}
]
}
}
},
{
#another scroll_id. Removed the data as its huge.
}
]
My question is, where are the unique results present in the above case?
is it within [hits][hits] or are they within "aggregation"? if within aggregation, for a million records, aggregation is returning me only 10 results. and If I depend on [hits][hits] from each scroll list, then the results are repetitive. I am trying to understand, which part of this result can I get the correct unique entries based on my above query constraint. Or is the query incorrectly formed or missing some parameter.
Appreciate any help.
Thanks.
elasticsearch
asked Nov 16 '18 at 0:33
RM02RM02
1
add a comment |
I am working on a specific query in ElasticSearch. The goal of the query is to return all the unique results with latest timestamps.
So just to give the background, in the elasticsearch DB, there can be mulitple entries for each of these unique field "x" with different timestamps. I want the ES query to return the latest timestamps for each of these unique field x.
So data looks like in the ES database:
{"x" : "1", "time": 1536574915}
{"x" : "2", "time": 1536574919}
{"x" : "1", "time": 1536574815}
{"x" : "2", "time": 1536574819}
{"x" : "3", "time": 1536574915}
{"x" : "4", "time": 1536574915}
Expected output is
{"x" : "1", "time": 1536574915}
{"x" : "2", "time": 1536574919}
{"x" : "3", "time": 1536574915}
{"x" : "4", "time": 1536574915}
The query I am currently using is:
{
"size": 0,
"query": {
"bool": {
"must": ,
"filter": {
"range": {
"time": {
"lte": "2019-11-16", Can give epoch conversion here
"format": "date_optional_time"
}
}
}
}
},
"aggs": {
"group_by": {
"terms": {
"field": "x"
},
"aggs": {
"resource": {
"terms": {
"field": "time",
"size": 1,
"order": {
"_key": "desc"
}
},
"aggs": {
"include_source": {
"top_hits": {
"from": 0,
"size": 1,
"_source": {}
}
}
}
}
}
}
}
}
The results that get returned on above query have
[
{
"_scroll_id": "DnF1ZXJ5VGhlbkZldGNoAgAAAAAAAAECFmtnNUY4dHFKUXVldXdQMkNSaE1femcAAAAAAAABAxZrZzVGOHRxSlF1ZXV3UDJDUmhNX3pn",
"took": 227,
"timed_out": false,
"_shards": {
"total": 2,
"successful": 2,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 343533,
"max_score": 0.0,
"hits": [
{
}
]
},
"aggregations": {
"group_by": {
"doc_count_error_upper_bound": 4,
"sum_other_doc_count": 343513,
"buckets": [
{ # here is the actual data.
}
]
}
}
},
{
#another scroll_id. Removed the data as its huge.
}
]
My question is, where are the unique results present in the above case?
is it within [hits][hits] or are they within "aggregation"? if within aggregation, for a million records, aggregation is returning me only 10 results. and If I depend on [hits][hits] from each scroll list, then the results are repetitive. I am trying to understand, which part of this result can I get the correct unique entries based on my above query constraint. Or is the query incorrectly formed or missing some parameter.
Appreciate any help.
Thanks.
elasticsearch
asked Nov 16 '18 at 0:33
RM02RM02
1
I am working on a specific query in ElasticSearch. The goal of the query is to return all the unique results with latest timestamps.
So just to give the background, in the elasticsearch DB, there can be mulitple entries for each of these unique field "x" with different timestamps. I want the ES query to return the latest timestamps for each of these unique field x.
So data looks like in the ES database:
{"x" : "1", "time": 1536574915}
{"x" : "2", "time": 1536574919}
{"x" : "1", "time": 1536574815}
{"x" : "2", "time": 1536574819}
{"x" : "3", "time": 1536574915}
{"x" : "4", "time": 1536574915}
Expected output is
{"x" : "1", "time": 1536574915}
{"x" : "2", "time": 1536574919}
{"x" : "3", "time": 1536574915}
{"x" : "4", "time": 1536574915}
The query I am currently using is:
{
"size": 0,
"query": {
"bool": {
"must": ,
"filter": {
"range": {
"time": {
"lte": "2019-11-16", Can give epoch conversion here
"format": "date_optional_time"
}
}
}
}
},
"aggs": {
"group_by": {
"terms": {
"field": "x"
},
"aggs": {
"resource": {
"terms": {
"field": "time",
"size": 1,
"order": {
"_key": "desc"
}
},
"aggs": {
"include_source": {
"top_hits": {
"from": 0,
"size": 1,
"_source": {}
}
}
}
}
}
}
}
}
The results that get returned on above query have
[
{
"_scroll_id": "DnF1ZXJ5VGhlbkZldGNoAgAAAAAAAAECFmtnNUY4dHFKUXVldXdQMkNSaE1femcAAAAAAAABAxZrZzVGOHRxSlF1ZXV3UDJDUmhNX3pn",
"took": 227,
"timed_out": false,
"_shards": {
"total": 2,
"successful": 2,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 343533,
"max_score": 0.0,
"hits": [
{
}
]
},
"aggregations": {
"group_by": {
"doc_count_error_upper_bound": 4,
"sum_other_doc_count": 343513,
"buckets": [
{ # here is the actual data.
}
]
}
}
},
{
#another scroll_id. Removed the data as its huge.
}
]
My question is, where are the unique results present in the above case?
is it within [hits][hits] or are they within "aggregation"? if within aggregation, for a million records, aggregation is returning me only 10 results. and If I depend on [hits][hits] from each scroll list, then the results are repetitive. I am trying to understand, which part of this result can I get the correct unique entries based on my above query constraint. Or is the query incorrectly formed or missing some parameter.
Appreciate any help.
Thanks.
elasticsearch
elasticsearch
asked Nov 16 '18 at 0:33
RM02RM02
1
asked Nov 16 '18 at 0:33
RM02RM02
1
asked Nov 16 '18 at 0:33
RM02RM02
1
asked Nov 16 '18 at 0:33
RM02RM02
1
asked Nov 16 '18 at 0:33
RM02RM02
1
1
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Your aggregation is not correct since you're retrieving the top hits for each x and time, while your goal is to retrieve the latest hit for each x. You need to modify your query like below, i.e. you only aggregate by x and in your top_hits sub-aggregation you sort documents by decreasing time and only take the last one.
{
"size": 0,
"aggs": {
"group_by": {
"terms": {
"field": "x"
},
"aggs": {
"resource": {
"top_hits": {
"from": 0,
"size": 1,
"sort": {
"time": "desc"
},
"_source": {}
}
}
}
}
}
}
The documents you're looking for are in the resource.hits.hits section of each of your buckets:
"aggregations" : {
"group_by" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "1",
"doc_count" : 2,
"resource" : {
"hits" : {
"total" : 2,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "PZt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "1",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
},
{
"key" : "2",
"doc_count" : 2,
"resource" : {
"hits" : {
"total" : 2,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "Ppt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "2",
"time" : 1536574919
},
"sort" : [
1536574919
]
}
]
}
}
},
{
"key" : "3",
"doc_count" : 1,
"resource" : {
"hits" : {
"total" : 1,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "QZt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "3",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
},
{
"key" : "4",
"doc_count" : 1,
"resource" : {
"hits" : {
"total" : 1,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "Qpt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "4",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
}
]
}
}
answered Nov 16 '18 at 7:48
ValVal
108k6147181
Thanks for the brief explanation. But does this above query hold true if you are expecting a unique "x"s that are more than 10 ? Does aggregation by any chance bound your results to displaying only 10 entries ?? My record size is 1 million and have all unique "x"s. Can I expect to see these 1 million records in the aggregation bucket ? if not, then how can I see all the 1 million unique records ? Please help me understand this.
– RM02
Nov 16 '18 at 18:36
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53329784%2funderstanding-aggregation-results-on-elasticsearch%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Your aggregation is not correct since you're retrieving the top hits for each x and time, while your goal is to retrieve the latest hit for each x. You need to modify your query like below, i.e. you only aggregate by x and in your top_hits sub-aggregation you sort documents by decreasing time and only take the last one.
{
"size": 0,
"aggs": {
"group_by": {
"terms": {
"field": "x"
},
"aggs": {
"resource": {
"top_hits": {
"from": 0,
"size": 1,
"sort": {
"time": "desc"
},
"_source": {}
}
}
}
}
}
}
The documents you're looking for are in the resource.hits.hits section of each of your buckets:
"aggregations" : {
"group_by" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "1",
"doc_count" : 2,
"resource" : {
"hits" : {
"total" : 2,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "PZt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "1",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
},
{
"key" : "2",
"doc_count" : 2,
"resource" : {
"hits" : {
"total" : 2,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "Ppt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "2",
"time" : 1536574919
},
"sort" : [
1536574919
]
}
]
}
}
},
{
"key" : "3",
"doc_count" : 1,
"resource" : {
"hits" : {
"total" : 1,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "QZt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "3",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
},
{
"key" : "4",
"doc_count" : 1,
"resource" : {
"hits" : {
"total" : 1,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "Qpt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "4",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
}
]
}
}
answered Nov 16 '18 at 7:48
ValVal
108k6147181
Thanks for the brief explanation. But does this above query hold true if you are expecting a unique "x"s that are more than 10 ? Does aggregation by any chance bound your results to displaying only 10 entries ?? My record size is 1 million and have all unique "x"s. Can I expect to see these 1 million records in the aggregation bucket ? if not, then how can I see all the 1 million unique records ? Please help me understand this.
– RM02
Nov 16 '18 at 18:36
add a comment |
Your aggregation is not correct since you're retrieving the top hits for each x and time, while your goal is to retrieve the latest hit for each x. You need to modify your query like below, i.e. you only aggregate by x and in your top_hits sub-aggregation you sort documents by decreasing time and only take the last one.
{
"size": 0,
"aggs": {
"group_by": {
"terms": {
"field": "x"
},
"aggs": {
"resource": {
"top_hits": {
"from": 0,
"size": 1,
"sort": {
"time": "desc"
},
"_source": {}
}
}
}
}
}
}
The documents you're looking for are in the resource.hits.hits section of each of your buckets:
"aggregations" : {
"group_by" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "1",
"doc_count" : 2,
"resource" : {
"hits" : {
"total" : 2,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "PZt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "1",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
},
{
"key" : "2",
"doc_count" : 2,
"resource" : {
"hits" : {
"total" : 2,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "Ppt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "2",
"time" : 1536574919
},
"sort" : [
1536574919
]
}
]
}
}
},
{
"key" : "3",
"doc_count" : 1,
"resource" : {
"hits" : {
"total" : 1,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "QZt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "3",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
},
{
"key" : "4",
"doc_count" : 1,
"resource" : {
"hits" : {
"total" : 1,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "Qpt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "4",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
}
]
}
}
answered Nov 16 '18 at 7:48
ValVal
108k6147181
Thanks for the brief explanation. But does this above query hold true if you are expecting a unique "x"s that are more than 10 ? Does aggregation by any chance bound your results to displaying only 10 entries ?? My record size is 1 million and have all unique "x"s. Can I expect to see these 1 million records in the aggregation bucket ? if not, then how can I see all the 1 million unique records ? Please help me understand this.
– RM02
Nov 16 '18 at 18:36
add a comment |
Your aggregation is not correct since you're retrieving the top hits for each x and time, while your goal is to retrieve the latest hit for each x. You need to modify your query like below, i.e. you only aggregate by x and in your top_hits sub-aggregation you sort documents by decreasing time and only take the last one.
{
"size": 0,
"aggs": {
"group_by": {
"terms": {
"field": "x"
},
"aggs": {
"resource": {
"top_hits": {
"from": 0,
"size": 1,
"sort": {
"time": "desc"
},
"_source": {}
}
}
}
}
}
}
The documents you're looking for are in the resource.hits.hits section of each of your buckets:
"aggregations" : {
"group_by" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "1",
"doc_count" : 2,
"resource" : {
"hits" : {
"total" : 2,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "PZt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "1",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
},
{
"key" : "2",
"doc_count" : 2,
"resource" : {
"hits" : {
"total" : 2,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "Ppt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "2",
"time" : 1536574919
},
"sort" : [
1536574919
]
}
]
}
}
},
{
"key" : "3",
"doc_count" : 1,
"resource" : {
"hits" : {
"total" : 1,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "QZt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "3",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
},
{
"key" : "4",
"doc_count" : 1,
"resource" : {
"hits" : {
"total" : 1,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "Qpt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "4",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
}
]
}
}
answered Nov 16 '18 at 7:48
ValVal
108k6147181
Your aggregation is not correct since you're retrieving the top hits for each x and time, while your goal is to retrieve the latest hit for each x. You need to modify your query like below, i.e. you only aggregate by x and in your top_hits sub-aggregation you sort documents by decreasing time and only take the last one.
{
"size": 0,
"aggs": {
"group_by": {
"terms": {
"field": "x"
},
"aggs": {
"resource": {
"top_hits": {
"from": 0,
"size": 1,
"sort": {
"time": "desc"
},
"_source": {}
}
}
}
}
}
}
The documents you're looking for are in the resource.hits.hits section of each of your buckets:
"aggregations" : {
"group_by" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "1",
"doc_count" : 2,
"resource" : {
"hits" : {
"total" : 2,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "PZt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "1",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
},
{
"key" : "2",
"doc_count" : 2,
"resource" : {
"hits" : {
"total" : 2,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "Ppt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "2",
"time" : 1536574919
},
"sort" : [
1536574919
]
}
]
}
}
},
{
"key" : "3",
"doc_count" : 1,
"resource" : {
"hits" : {
"total" : 1,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "QZt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "3",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
},
{
"key" : "4",
"doc_count" : 1,
"resource" : {
"hits" : {
"total" : 1,
"max_score" : null,
"hits" : [
{
"_index" : "times",
"_type" : "doc",
"_id" : "Qpt7G2cBJos57mIu0oy-",
"_score" : null,
"_source" : {
"x" : "4",
"time" : 1536574915
},
"sort" : [
1536574915
]
}
]
}
}
}
]
}
}
answered Nov 16 '18 at 7:48
ValVal
108k6147181
answered Nov 16 '18 at 7:48
ValVal
108k6147181
answered Nov 16 '18 at 7:48
ValVal
108k6147181
answered Nov 16 '18 at 7:48
ValVal
108k6147181
108k6147181
Thanks for the brief explanation. But does this above query hold true if you are expecting a unique "x"s that are more than 10 ? Does aggregation by any chance bound your results to displaying only 10 entries ?? My record size is 1 million and have all unique "x"s. Can I expect to see these 1 million records in the aggregation bucket ? if not, then how can I see all the 1 million unique records ? Please help me understand this.
– RM02
Nov 16 '18 at 18:36
add a comment |
Thanks for the brief explanation. But does this above query hold true if you are expecting a unique "x"s that are more than 10 ? Does aggregation by any chance bound your results to displaying only 10 entries ?? My record size is 1 million and have all unique "x"s. Can I expect to see these 1 million records in the aggregation bucket ? if not, then how can I see all the 1 million unique records ? Please help me understand this.
– RM02
Nov 16 '18 at 18:36
Thanks for the brief explanation. But does this above query hold true if you are expecting a unique "x"s that are more than 10 ? Does aggregation by any chance bound your results to displaying only 10 entries ?? My record size is 1 million and have all unique "x"s. Can I expect to see these 1 million records in the aggregation bucket ? if not, then how can I see all the 1 million unique records ? Please help me understand this.
– RM02
Nov 16 '18 at 18:36
Thanks for the brief explanation. But does this above query hold true if you are expecting a unique "x"s that are more than 10 ? Does aggregation by any chance bound your results to displaying only 10 entries ?? My record size is 1 million and have all unique "x"s. Can I expect to see these 1 million records in the aggregation bucket ? if not, then how can I see all the 1 million unique records ? Please help me understand this.
– RM02
Nov 16 '18 at 18:36
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53329784%2funderstanding-aggregation-results-on-elasticsearch%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
