How to aggregate between multiple indices in Elasticsearch? -


i using elasticsearch 5.3.in it, have 2 indices, log1 , log2. want aggregation on both of them @ same time. store different data share same data single field, sessionid. in following query, fields location , event in log1 , logentrytime , event in log2. field event in both indices contain different data. data init , exit present in log2.

curl -xget '127.0.0.1:9200/log1,log2/_search?pretty' -h 'content-type: application/json' -d ' {   "aggs": {     "sessions": {       "terms": { "field" : "sessionid" },       "aggs": {         "docs": {           "top_hits": {             "size": 1,             "_source": [ "location" ]           }         },         "event_count": { "value_count" : { "field" : "event" } },         "events" : {           "filters" : {             "filters" : {               "inits" :   { "match" : { "event" : "init" }},               "exits" : { "match" : { "event" : "exit" }}             }           },           "aggs": {             "time": {               "top_hits": {                 "size": 1,                 "_source": [ "logentrytime" ]               }             }           }         }       }     }   } }' 

the purpose of query number of events per session id , corresponding location log1 , logentrytime log2 when event init , exit. query right not return data log2, part log1 returning data.

what problem , how fix it?


Comments

Popular posts from this blog

Command prompt result in label. Python 2.7 -

javascript - How do I use URL parameters to change link href on page? -

amazon web services - AWS Route53 Trying To Get Site To Resolve To www -