aggregating properties in elastic search

Question

I have an indexed entry that has optional properties. So, for example, I have entries like this

{
  "id":1
  "field1":"XYZ"
},
{
  "id":2
  "field2":"XYZ"
},
{
  "id":3
  "field1":"XYZ"
}

I would like to make an aggregation that will tell me how many entries I have with field1 and field2 populated.

The expected result should be:

{
"field1":2
"field2":1
}

Is this even possible with elasticsaerch?

Answer 1

Yes, you can do it like this:

POST myindex/_search
{
  "size": 0,
  "aggs": {
    "field_exists": {
      "filters": {
        "filters": {
          "field1": {
            "exists": {
              "field": "field1"
            }
          },
          "field2": {
            "exists": {
              "field": "field2"
            }
          }
        }
      }
    }
  }
}

You'll get an answer like this one:

"aggregations" : {
  "field_exists" : {
    "buckets" : {
      "field1" : {
        "doc_count" : 2
      },
      "field2" : {
        "doc_count" : 1
      }
    }
  }
}