Elasticsearch bucket_script returns no output - elasticsearch

Question

I created an index like that:
{
"mappings":{
"properties":{
"#timestamp":{
"type":"date",
"doc_values":true
},
"event.category":{
"type":"keyword",
"index":true
},
"action":{
"type":"keyword",
"index":true
},
"success":{
"type":"boolean",
"index":true
},
"raw":{
"type":"text",
"index":false
}
}
}
}
Then I tried to use bucket_script pipeline aggregation to calculate success rate over actions, searching like that
{
"size": 0,
"_source": false,
"query": {
"bool": {
"filter": [{
"term": {
"action": "login"
}
}
]
}
},
"aggs": {
"action_bucket": {
"terms": {
"field": "action",
"show_term_doc_count_error": true
},
"aggs": {
"total": {
"terms": {
"field": "action"
}
},
"action": {
"filter": {
"term": {
"success": true
}
},
"aggs": {
"success": {
"terms": {
"field": "action"
}
}
}
},
"action_success_rate": {
"bucket_script": {
"buckets_path": {
"no_total": "total.doc_count",
"no_success": "action>success.doc_count"
},
"script": "100 * params.no_success / params.no_total"
}
}
}
}
}
}
And inside the response there is not action_success_rate:
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 15,
"relation": "eq"
},
"max_score": null,
"hits": []
},
"aggregations": {
"action_bucket": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "login",
"doc_count": 15,
"doc_count_error_upper_bound": 0,
"total": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "login",
"doc_count": 15
}
]
},
"action": {
"doc_count": 9,
"success": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "login",
"doc_count": 9
}
]
}
}
}
]
}
}
}
How could I fix my search request body to obtain success rate?

Answer 1

Mapping:
{
"mappings":{
"properties":{
"#timestamp":{
"type":"date",
"doc_values":true
},
"event.category":{
"type":"keyword",
"index":true
},
"action":{
"type":"keyword",
"index":true
},
"success":{
"type":"boolean",
"index":true
},
"raw":{
"type":"text",
"index":false
}
}
}
}
Sample Data:
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 5,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "idx0",
"_type" : "_doc",
"_id" : "E802dnkBHcKLV4rtwh3V",
"_score" : 1.0,
"_source" : {
"action" : "login",
"success" : true
}
},
{
"_index" : "idx0",
"_type" : "_doc",
"_id" : "FM02dnkBHcKLV4rtyx0r",
"_score" : 1.0,
"_source" : {
"action" : "login",
"success" : true
}
},
{
"_index" : "idx0",
"_type" : "_doc",
"_id" : "Fc02dnkBHcKLV4rt1x0t",
"_score" : 1.0,
"_source" : {
"action" : "login",
"success" : false
}
},
{
"_index" : "idx0",
"_type" : "_doc",
"_id" : "Fs04dnkBHcKLV4rtKR3P",
"_score" : 1.0,
"_source" : {
"action" : "logout",
"success" : false
}
},
{
"_index" : "idx0",
"_type" : "_doc",
"_id" : "F804dnkBHcKLV4rtNR3J",
"_score" : 1.0,
"_source" : {
"action" : "logout",
"success" : true
}
}
]
}
}
Query:
{
"size": 0,
"aggs": {
"actions": {
"terms": {
"field": "action.keyword",
"size": 10
},
"aggs": {
"total": {
"value_count": {
"field": "action.keyword"
}
},
"success":{
"filter": {
"term": {
"success":true
}
},
"aggs": {
"success_cnt": {
"value_count": {
"field": "action.keyword"
}
}
}
},
"success_rate":{
"bucket_script": {
"buckets_path": {
"no_total":"total.value",
"no_success":"success>success_cnt.value"
},
"script": "(params.no_success/params.no_total)*100"
}
}
}
}
}
}
Response:
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 5,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"actions" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "login",
"doc_count" : 3,
"total" : {
"value" : 3
},
"success" : {
"doc_count" : 2,
"success_cnt" : {
"value" : 2
}
},
"success_rate" : {
"value" : 66.66666666666666
}
},
{
"key" : "logout",
"doc_count" : 2,
"total" : {
"value" : 2
},
"success" : {
"doc_count" : 1,
"success_cnt" : {
"value" : 1
}
},
"success_rate" : {
"value" : 50.0
}
}
]
}
}
}