TransWikia.com

Elasticsearch Top level aggregation / search body metadata

Stack Overflow Asked by Joe - Elasticsearch Handbook on January 5, 2022

It’s possible to include sub-aggregation metadata like so:

GET kibana_sample_data_flights/_search
{
  "size": 0,
  "query": ...,
  "aggs": {
    "by_delay": {
      "terms": {
        "field": "FlightDelay"
      },
      "meta": {                <---
        "key": "val"
      }
    },
    "by_cancelled": {
      "terms": {
        "field": "Cancelled"
      },
      "meta": {                <---
        "key": "val"
      }
    }
  }
}

Now, there are dozens of such sub-aggs and some shared metadata. Although it only applies to the aggs, I wouldn’t mind putting it somewhere in the query section. So is there a per-search-body metadata field?

I’m thinking I could wrap all these sub-aggs inside of a match_all filter group:

{
  "size": 0,
  "query": ...,
  "aggs": {
    "meta_parent": {
      "filter": {
        "match_all": {}
      },
      "meta": {
        "shared": "meta"
      },
      "aggs": {
        "by_delay": ...,
        "by_cancelled": ...
      }
    }
  }
}

Is there a better way?

One Answer

If you don't have any query part, I would leverage the global aggregation, like this:

{
  "size": 0,
  "aggs": {
    "meta_parent": {
      "global": {},
      "meta": {
        "shared": "meta"
      },
      "aggs": {
        "by_delay": ...,
        "by_cancelled": ...
      }
    }
  }
}

Otherwise, what you suggested with a filter/match_all aggregation can work, too:

{
  "size": 0,
  "aggs": {
    "meta_parent": {
      "filter": {
        "match_all": {}
      },
      "meta": {
        "shared": "meta"
      },
      "aggs": {
        "by_delay": ...,
        "by_cancelled": ...
      }
    }
  }
}

Answered by Val on January 5, 2022

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP