弹性搜索 - 嵌套聚合

Question

I would like to form a nested aggregation type query in elastic search. Basically, the nested aggregation is at four levels.

groupId.keyword ---direction --billingCallType --durationCallAnswered

example:

"aggregations": {
        "avgCallDuration": {
            "terms": {
                "field": "groupId.keyword",
                "size": 10000,
                "min_doc_count": 1,
                "shard_min_doc_count": 0,
                "show_term_doc_count_error": false,
                "order": [
                    {
                        "_count": "desc"
                    },
                    {
                        "_key": "asc"
                    }
                ]
            },
            "aggregations": {
                "call_direction": {
                    "terms" : {
                        "field": "direction"
                    },
                    "aggregations": {
                        "call_type" : {
                            "terms": {
                                "field": "billingCallType"
                            },
                        
                            "aggregations": {
                                "avg_value": {
                                    "terms": {
                                        "field": "durationCallAnswered"
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }

This is part of a query. While running this, I am getting the error as
"type" : "illegal_argument_exception", "reason" : "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [direction] in order to load field data by uninverting the inverted index. Note that this can use significant memory."

Can anyone throw light on this?

Answer 1

Tldr;

As the error state, you are performing an aggregation on a text field, the field direction .

Aggregation are not supported by default on text field, as it is very expensive (cpu and memory wise).

They are 3 solutions to your issue,

1. Change the mapping from text to keyword (will require re indexing , most efficient way to query the data)
2. Change the mapping to add to this field fielddata: true (flexible, but not optimised)
3. Don't do the aggregation on this field:)