在Elasticsearch中由两个或多个字段聚合

Question

I have many documents with various ProcessName . Each has some status code named Code .

I need to aggregate the documents by those two fields.

For instance:

ProcessA 
code: 1
count: 220 

ProcessA 
code: 2
count: 335

ProcessB
code: 2
count: 520 

ProcessC
code: 3
count: 520 

I've managed to aggregate only by one field ( ProcessName ):

POST /_search
{
  "query": {
        "bool": {
          "must": [
            {
              "term": {
                "_type": "monitor"
              }
            }
          ]
        }
  },
  "aggs" : {
        "ProcessNameAgg" : {
            "terms" : { "field" : "ProcessName",
                        "size" : 5,
                        "order" : { "_count" : "desc" }
            }
        }
  }
}

I've tried to make terms an array with two fields, but unfortunately I'm getting parsing exception (terms should get ONLY one field).

Answer 1

Try this:

POST /_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "_type": "monitor"
          }
        }
      ]
    }
  },
  "aggs": {
    "ProcessNameAgg": {
      "terms": {
        "field": "ProcessName",
        "size": 5,
        "order": {
          "_count": "desc"
        }
      },
      "aggs": {
        "codes": {
          "terms": {
            "field": "code",
            "size": 10
          }
        }
      }
    }
  }
}