如何在Elasticsearch中使用文本字段过滤器聚合数据？

Question

Having read all the tutorials on ES website, I cannot achieve my goal. We are using ES 1.7.6 and I want to have only one single instance of documents matching my criteria. But what I get from ES is all the data matching the filter and the aggregation statistics.

GET _search
{
   "size":1000,
   "query":{
      "bool":{
         "should":[
            {
               "match":{
                  "isoMessage.fields.39":{
                     "query":"00"
                  }
               }
            }
         ]
      }
   },
   "aggs":{
      "group_by_CATI":{
         "terms":{
            "field":"isoMessage.fields.41"
         }
      }
   }
}

Note that the index of isoMessage.fields.41 is set to not_analyzed . Thanks for any help;

UPDATE: The mapping

{
    "cm": {
        "mappings": {
            "Event": {
                "properties": {
                    "deleted": {
                        "type": "boolean"
                    },
                    "id": {
                        "type": "string"
                    },
                    "isoMessage": {
                        "properties": {
                            "fields": {
                                "properties": {
                                    "2": {
                                        "type": "string"
                                    },
                                    "3": {
                                        "type": "string"
                                    },
                                    "4": {
                                        "type": "string"
                                    },
                                    "7": {
                                        "type": "string"
                                    },
                                    "11": {
                                        "type": "string"
                                    },
                                    "12": {
                                        "type": "string"
                                    },
                                    "13": {
                                        "type": "string"
                                    },
                                    "14": {
                                        "type": "string"
                                    },
                                    "22": {
                                        "type": "string"
                                    },
                                    "25": {
                                        "type": "string"
                                    },
                                    "32": {
                                        "type": "string"
                                    },
                                    "37": {
                                        "type": "string"
                                    },
                                    "39": {
                                        "type": "string"
                                    },
                                    "41": {
                                        "type": "string"
                                    },
                                    "42": {
                                        "type": "string"
                                    },
                                    "48": {
                                        "type": "string"
                                    },
                                    "49": {
                                        "type": "string"
                                    },
                                    "60": {
                                        "type": "string"
                                    },
                                    "63": {
                                        "type": "string"
                                    },
                                    "100": {
                                        "type": "string"
                                    },
                                    "128": {
                                        "type": "string"
                                    }
                                }
                            },
                            "isReversal": {
                                "type": "boolean"
                            },
                            "isReversalDone": {
                                "type": "boolean"
                            },
                            "messageSpec": {
                                "type": "string"
                            },
                            "mti": {
                                "type": "string"
                            },
                            "request": {
                                "type": "boolean"
                            },
                            "response": {
                                "type": "boolean"
                            }
                        }
                    },
                    "msg": {
                        "type": "string"
                    },
                    "occurDate": {
                        "type": "long"
                    },
                    "receiver": {
                        "type": "string"
                    },
                    "rrn": {
                        "type": "string"
                    },
                    "sender": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "txId": {
                        "type": "string"
                    },
                    "version": {
                        "type": "long"
                    }
                }
            }
        }
    }
}

Answer 1

If I understand correctly, and you want to get only the aggregation result:

Change your size field from:

"size":1000

to

"size":0

in order to set the _search query displayed results limit. It won't affect the aggregation result, though.