Kibana: vega-lite visualizations if data result is empty - elasticsearch

I'm trying to create a vega-lite visualization with a query. But if the result of the query is return empty, I get the "cannot read property 'xx' undefined" message. Some part of my visualization code is below:
{
$schema: https://vega.github.io/schema/vega-lite/v2.6.0.json
data: {
name: our_data
url: {
index: index-7.0.1-index*
body: {
query: {
bool: {
filter: [
{
match_all: {}
}
{
match_all: {}
}
]
should: []
must_not: []
}
}
aggs: {
xx: {
top_hits: {
docvalue_fields: [
{
field: someField
format: use_field_mapping
}
]
_source: ["someField"]
size: 1
sort: [
{
#timestamp: {order: "desc"}
}
]
}
}
}
}
}
format: {property: "aggregations.xx.hits.hits"}
}
Is there any way not to get "cannot read property 'xx' undefined" message? I just want if there is no data result, vega-lite visualization looks blank.
Thank you.

Related

Elasticsearch OR query returns unmatched results

Im trying to use Should to do an OR query, heres my code ..
{
bool:
{
must: [
{match: { category: "Baby" } }
],
should: [
{ match: { isPublic: true } },
{ match: { somethingElse: true } }
]
}
}
I want it to return results only when one of these should matches occurs, but its returning results where these conditions are not met. How can i make an OR query with similar syntax (im constructing queries dynamically so thats quite important) that will only return results that are both category: "Baby" and EITHER isPublic: true or somethingElse: true?
Thanks
You simply need to add minimum_should_match: 1
{
bool:
{
must: [
{match: { category: "Baby" } }
],
minimum_should_match: 1, <--- add this
should: [
{ match: { isPublic: true } },
{ match: { somethingElse: true } }
]
}
}

Delete all documents with a certain property value?

I'm trying to delete all documents where a certain property has a certain value. The code below is my best attempt, but the ES API returns a parse error:
const userProperty = "couchDbOrigin";
client.deleteByQuery({
index: "_all",
body: { query: { bool: { must: [{ terms: { [userProperty]: user } }] } } }
});
What is wrong with this code?
terms query expect criteria as an array :
so you should use :
client.deleteByQuery({
index: "_all",
body: { query: { bool: { must: [{ terms: { [userProperty]: [user] } }] } } }
});
But if you delete document for one user at a time, you should use a term query that expects a single value and can perform better
client.deleteByQuery({
index: "_all",
body: { query: { bool: { must: [{ term: { [userProperty]: user } }] } } }
});

elasticsearch: cannot search for # symbol

Our mapping looks like this:
mappings: {
entry: {
properties: {
id: { type: 'string' },
name: { type: 'string' },
creationTimestamp: { type: 'date', format: 'date_time' },
lastTimestamp: { type: 'date', format: 'date_time' }
}
}
}
There are docs that contain # symbols in the name, like for example "#TITLE#_30". However, I am not able to search for the # symbol. Searching for name:*title* or name:*_30* works fine, but when trying name:*#title* I get no results.
Which tokenizer do I have to use so that this is possible? What our end-users want to do is just case insensitive searches with wildcards.
EDIT
The query looks like this:
query: {
filtered: {
filter: {
bool: {
must: [{
range: {
creationTimestamp: {
gte: startdate.toISOString(),
lte: enddate.toISOString()
}
},
query: {
query_string: {
query: 'name:*title*' // e.g
}
}
}]
}
}
}
}
P.S. we use es v1.7
EDIT 2
Tried the 2 options from How to modify standard analyzer to include #? but they don't work for me.
Also tried the following:
settings: {
analysis: {
analyzer: {
name_analyzer: {
type: 'custom',
tokenizer: 'whitespace',
filter: ['test']
}
},
filter: {
test: {
type: 'word_delimiter',
preserve_original: true,
type_table: ['# => ALPHANUM']
}
}
}
}
but this only gets results for name:*#* and any other query doesn't work

Elastic search returning wrong results

I am running a query against elastic search but the results returned are wrong. The idea is that I can check against a range of fields with individual queries. But when I pass the following query, items which don't have the included lineup are returned.
query: {
bool: {
must: [
{match:{"lineup.name":{query:"The 1975"}}}
]
}
}
The objects are events which looks like.
{
title: 'Glastonbury'
country: 'UK',
lineup: [
{
name: 'The 1975',
genre: 'Indie',
headliner: false
}
]
},
{
title: 'Reading'
country: 'UK',
lineup: [
{
name: 'The Strokes',
genre: 'Indie',
headliner: true
}
]
}
In my case both of these events are returned.
The mapping can be seen here:
https://jsonblob.com/567e8f10e4b01190df45bb29
You need to use match_phrase query, match query is looking for either The or 1975 and it find The in The strokes and it gives you that result.
Try
{
"query": {
"bool": {
"must": [
{
"match": {
"lineup.name": {
"query": "The 1975",
"type": "phrase"
}
}
}
]
}
}
}

Multiple types in Elasticsearch Type Filter

I have a filtered query like this
query: {
filtered: {
query: {
bool: {
should: [{multi_match: {
query: #query,
fields: ['title', 'content']
}
},{fuzzy: {
content: {
value: #query,
min_similarity: '1d',
}
}}]
}
},
filter: {
and: [
type: {
value: #type
}]
}}}
That works fine if #type is a string, but does not work if #type is an array. How can I search for multiple types?
This worked, but I'm not happy with it:
filter: {
or: [
{ type: { value: 'blog'} },
{ type: { value: 'category'} },
{ type: { value: 'miscellaneous'} }
]
}
I'd love to accept a better answer
You can easily specify multiple types in your search request's URL, e.g. http://localhost:9200/twitter/tweet,user/_search, or with type in the header if using _msearch, as documented here.
These are then added as filters for you by Elasticsearch.
Also, you usually want to be using bool to combine filters, for reasons described in this article: all about elasticsearch filter bitsets
This worked for me:
Within the filter parameter, wrap multiple type queries as should clauses for a bool query
e.g
{
"query": {
"bool": {
"must": {
"term": { "foo": "bar" }
},
"filter": {
"bool": {
"should": [
{ "type": { "value": "myType" } },
{ "type": { "value": "myOtherType" } }
]
}
}
}
}
}
Suggested by dadoonet in the Elasticsearch github issue Support multiple types in Type Query

Resources