Unable to run elastic search nested aggregate query - elasticsearch

Question

I am trying to create a query that aggregates the sum of 3 different field and also matches three different conditions. I don't understand what the error message is saying.
The query below gives this specific error message:
{
"error": {
"root_cause": [
{
"type": "parsing_exception",
"reason": "Unknown key for a VALUE_NUMBER in [Type].",
"line": 1,
"col": 9
}
],
"type": "parsing_exception",
"reason": "Unknown key for a VALUE_NUMBER in [Type].",
"line": 1,
"col": 9
}
}
My query looks as follow:
{
"aggs": {
"filtered": {
"filter": {
"bool": {
"must": [
{
"term": {
"data.entity.productId": "45c29143b3bb4073a9fd325106784ce2"
}
},
{
"term": {
"data.entity.locationId": "c5f45ffc4fd94dcb926f96f1d5b9d835"
}
},
{
"term": {
"type.keyword": "StockLocationActivityAggregate"
}
}
]
}
}
},
"aggs": {
"directStock": {
"sum": { "field": "data.entity.inStock" },
"aggs": {
"directOutgoing": {
"sum": { "field": "data.entity.outgoing" },
"aggs": {
"directIncoming": { "sum": { "field": "data.entity.incoming" } }
}
}
}
}
}
},
"size": 0
}
Update
I am using the following index map
{
"mapping": {
"_doc": {
"properties": {
"active": {
"type": "boolean"
},
"data": {
"properties": {
"entity": {
"properties": {
"activityDate": {
"type": "date"
},
"creationDate": {
"type": "date"
},
"deleted": {
"type": "boolean"
},
"hash": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"inStock": {
"type": "float"
},
"incoming": {
"type": "float"
},
"locationId": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"modifiedOn": {
"type": "date"
},
"modifier": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"orderId": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"orderItemId": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"outgoing": {
"type": "float"
},
"productId": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"reservationDate": {
"type": "date"
},
"version": {
"type": "long"
}
}
},
"hash": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"modifiedOn": {
"type": "date"
},
"modifier": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"tenantIdentifier": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"version": {
"type": "long"
}
}
},
"deleted": {
"type": "boolean"
},
"id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"tenantId": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"version": {
"type": "long"
}
}
}
}
}
I've also tried the example from the elastic search docs and the sample from Val below. They all give the same rror.

Answer 1

The sum aggregation is a metric aggregation that cannot have sub-aggregations... So you cannot do sum -> sum -> sum.
If you need the 3 different sums, you can do something like this:
{
...
"aggs": {
"directIncoming": {
"sum": {
"field": "data.entity.incoming"
}
},
"directStock": {
"sum": {
"field": "data.entity.inStock"
}
},
"directOutgoing": {
"sum": {
"field": "data.entity.outgoing"
}
}
}
}