Elasticsearch query and aggregation on indices

Question

I have multiple elasticsearch indices and I would like to get the doc_count of how many documents matched the query for each index (even if no documents matched for an index). I tried this (using elasticsearch.js):

{
  index: 'one,or,many,indices,here',
  query: {
    query_string: {
      query: 'hello',
    },
  },
  aggs: {
    group_by_index: {
      terms: {
        field: '_index',
        min_doc_count: 0,
      },
    },
  },
  from: 0,
  size: 20,
};

This only works if I specify all indices on the index key. However, I don't always want to match documents across all indices in my search hits.

So I came up with:

{
  index: 'all,indices,here',
  query: {
    bool: {
      must: [
        {
          query_string: {
            query: 'hello',
          },
        },
        {
          terms: {
            _index: 'only,search,hits,indices,here',
          },
        },
      ],
    },
  },
  aggs: {
    group_by_index: {
      terms: {
        field: '_index',
        min_doc_count: 0,
      },
    },
  },
  from: 0,
  size: 20,
};

But then I get doc_count: 0 for indices where there are matches because the index is not in the bool query.

How can I get the doc_count for all indices but not get search hits from unwanted indices?

Answer 1

You need to move your index constraint to post_filter

{
  index: 'all,indices,here',
  query: {
    bool: {
      must: [
        {
          query_string: {
            query: 'hello',
          },
        },
      ],
    },
  },
  aggs: {
    group_by_index: {
      terms: {
        field: '_index',
        min_doc_count: 0,
      },
    },
  },
  post_filter: {
    terms: {
      _index: 'only,search,hits,indices,here',
    },
  },
  from: 0,
  size: 20,
};