Aggregations elasticsearch 5

Question

In my elastic search index has following type of entries.

{
  "_index": "employees",
  "_type": "employee",
  "_id": "10000",
  "_score": 1.3640093,
  "_source": {
    "itms": {
      "depc": [
        "IT",
        "MGT",
        "FIN"
      ],
      "dep": [
        {
          "depn": "Information Technology",
          "depc": "IT"
        },
        {
          "depn": "Management",
          "depc": "MGT"
        },
        {
          "depn": "Finance",
          "depc": "FIN"
        },
        {
          "depn": "Finance",
          "depc": "FIN"
        }
      ]
    }
  }
}

Now I an trying to get unique department list including department code (depc) and department name (depn).

I was trying following but it doesn't give result what I expected.

{
  "size": 0,
  "query": {},
  "aggs": {
    "departments": {
      "terms": {
        "field": "itms.dep.depc",
        "size": 10000,
        "order": {
          "_term": "asc"
        }
      },
      "aggs": {
        "department": {
          "terms": {
            "field": "itms.dep.depn",
            "size": 10
          }
        }
      }
    }
  }
}

Any suggestions are appreciated.

Thanks You

Answer 1

From your agg query, it seems like the mapping type for itms.dep is object and not nested

Lucene has no concept of inner objects, so Elasticsearch flattens object hierarchies into a simple list of field names and values.

Hence, your doc has internally transformed to :

{
  "depc" :        ["IT","MGT","FIN"],
  "dep.depc" : [ "IT","MGT","FIN"],
  "dep.depn" :  [ "Information Technology", "Management", "Finance" ]
}

ie you have lost the association between depc and depn

To fix this :

1. You need to change your object type to nested
2. Use nested aggregation

The structure of your existing agg query seems fine to me but you will have to convert it to a nested aggregation post the mapping update