How to extract each elements of a list of dictionaries by its dictionary key from a json object?

Question

I have the below JSON output.

"aggregations" : {
    "test_groups" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "group1",
          "doc_count" : 1,
          "emails" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "abc@xyz.com",
                "doc_count" : 1
              }
            ]
          }
        },
        {
          "key" : "group2",
          "doc_count" : 1,
          "emails" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "xyz@abc.com",
                "doc_count" : 1
              }
            ]
          }
        }
      ]
    }
  }

Now I have to extract the key value for the first bucket under test_groups ie, "abc@xyz.com". I successfully achieve this by using the following variable.

{{ctx.payload.first.aggregations.test_groups.buckets.0.emails.buckets.0.key}}

I am looking for an alternative of fetching elements by index of a list ie test_groups.buckets.0. and want something like {{ctx.payload.first.aggregations.test_groups.buckets.group1.emails.buckets.0.key}} .

I want to use the key ( group1 ) instead of the index ( 0 ) of the 1st dictionary inside the list ( buckets ) to fetch the elements of that dictionary. Is it possible?

I'm new to JSON. Please help!

Edited: This is the search query for reference.

    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "index1"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "aggs": {
            "test_groups": {
              "terms": {
                "field": "test_group.keyword",
                "order": {
                  "_count": "desc"
                },
                "size": 1000
              },
              "aggs": {
                "emails": {
                  "terms": {
                    "field": "email.keyword",
                    "order": {
                      "_count": "desc"
                    },
                    "size": 1000
                  }
                }
              }
            }
          }
    }
}

}

Answer 1

First of all, are you able to change the JSON structure? If so, you could do something like this. Change it to the following structure. (Changed the List of buckets to a dictionary with group names as keys)

"aggregations": {
  "test_groups": {
    "doc_count_error_upper_bound": 0,
    "sum_other_doc_count": 0,
    "buckets": {
      "group1": {
        "key": "group1",
        "doc_count": 1,
        "emails": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 0,
          "buckets": [
            {
              "key": "abc@xyz.com",
              "doc_count": 1
            }
          ]
        }
      },
      "group2": {
        "key": "group2",
        "doc_count": 1,
        "emails": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 0,
          "buckets": [
            {
              "key": "xyz@abc.com",
              "doc_count": 1
            }
          ]
        }
      }
    }
  }
}

Then you should be able to access the groups the way you want. For example, if you want to get the email key of group1, you could try the following.

{{ctx.payload.first.aggregations.test_groups.buckets.group1.emails.buckets.0.key}}