Can an aggregation have two keys in elasticsearch - elasticsearch

Question

Suppose I have an index with a nested document that looks like this:
{
"mappings": {
"assignment": {
"properties":{
"id": {
"type": "string"
},
"location": {
"type": "string"
},
"typeOfLoss":{
"type": "string"
},
"lineItems": {
"type": "nested",
"properties": {
"categoryCode":{
"type": "string"
},
"selectorCode":{
"type": "string"
},
"roomType": {
"type": "string"
}
}
}
I now want to get a count aggregation of "lineItems" documents that returns the selectorCode and categoryCode where the roomType matches a search query. I am new to elasticsearch and can write my query in SQL
SELECT COUNT(*) as theCount, ln.category_code, ln.selector_code
FROM line_items as ln, assignment
WHERE assignment.location = "84043"
AND assignment.typeOfLoss = "Fire"
AND ln.roomType = "kitchen"
GROUP BY ln.category_code, ln.selector_code
ORDER BY theCount DESC;
I have started on the NEST query but am having some problems and am hoping someone can point me in the right directions.
var typeOfLossQuery = new TermQuery
{
Field = "typeOfLoss",
Value = typeOfLoss
};
var locationQuery = new TermQuery
{
Field = "location",
Value = location
};
var roomTypeQuery = new TermQuery
{
Field = "roomType",
Value = roomType
};
var result = client.Search<LineItem>(s => s
.From(0)
.Size(numberOfItems)
.Query(q => q.HasParent<Assignment>(a => a
.Query(x =>x
.MatchAll() && typeOfLossQuery && locationQuery
)
) && q.MatchAll() && roomTypeQuery
));

Answer 1

You can indeed do this with ElasticSearch but it's not quite as clean as in SQL. We can accomplish this with Nested Aggregations.
Setup
I'm going to setup the data so that you'd get the following equivalent result in SQL:
categoryCode | selectorCode | Count
c1 | s1 | 1
c1 | s2 | 2
PUT test1
PUT test1/_mapping/type1
{
"properties": {
"id": {
"type": "string"
},
"location": {
"type": "string"
},
"typeOfLoss": {
"type": "string"
},
"lineItems": {
"type": "nested",
"properties": {
"categoryCode": {
"type": "string",
"fielddata": true
},
"selectorCode": {
"type": "string",
"fielddata": true
},
"roomType": {
"type": "string"
}
}
}
}
}
POST test1/type1
{
"location":"l1",
"lineItems":
{
"categoryCode": "c1",
"selectorCode": "s1",
"roomType": "r1"
}
}
POST test1/type1
{
"location":"l1",
"lineItems":
{
"categoryCode": "c1",
"selectorCode": "s2",
"roomType": "r1"
}
}
POST test1/type1
{
"location":"l1",
"lineItems":
{
"categoryCode": "c1",
"selectorCode": "s2",
"roomType": "r1"
}
}
Query
GET test1/type1/_search
{
"size": 0,
"query": {
"nested": {
"path": "lineItems",
"query": {
"term": {
"lineItems.roomType": {
"value": "r1"
}
}
}
}
},
"aggs": {
"nestedAgg": {
"nested": {
"path": "lineItems"
},
"aggs": {
"byCategory": {
"terms": {
"field": "lineItems.categoryCode",
"size": 10
},
"aggs": {
"bySelector": {
"terms": {
"field": "lineItems.selectorCode",
"size": 10
}
}
}
}
}
}
}
}
My query is saying the following:
only show me data where roomType = 'r1'
aggregate (group in SQL) by categoryCode
created a "nested" or "sub" aggregation on "selectorCode"
Result
{
"took": 6,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 3,
"max_score": 0,
"hits": []
},
"aggregations": {
"nestedAgg": {
"doc_count": 3,
"byCategory": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "c1",
"doc_count": 3,
"bySelector": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "s2",
"doc_count": 2
},
{
"key": "s1",
"doc_count": 1
}
]
}
}
]
}
}
}
}
So the results returns a list of aggregations. Inside an aggregation is a "bucket". Notice that the outer bucket for byCategory shows a doc_count of 3. That's because there are 3 records that match in the DB.
Then, nested inside that is the bySelector bucket showing s2 and s1 with a doc_count of 2 and 1 respectively.
Hopefully that helps, I'll let you turn all this into a NEST query.