How to aggregate between multiple indices in Elasticsearch? -
i using elasticsearch 5.3.in it, have 2 indices, log1
, log2
. want aggregation on both of them @ same time. store different data share same data single field, sessionid
. in following query, fields location
, event
in log1
, logentrytime
, event
in log2
. field event
in both indices contain different data. data init
, exit
present in log2
.
curl -xget '127.0.0.1:9200/log1,log2/_search?pretty' -h 'content-type: application/json' -d ' { "aggs": { "sessions": { "terms": { "field" : "sessionid" }, "aggs": { "docs": { "top_hits": { "size": 1, "_source": [ "location" ] } }, "event_count": { "value_count" : { "field" : "event" } }, "events" : { "filters" : { "filters" : { "inits" : { "match" : { "event" : "init" }}, "exits" : { "match" : { "event" : "exit" }} } }, "aggs": { "time": { "top_hits": { "size": 1, "_source": [ "logentrytime" ] } } } } } } } }'
the purpose of query number of events per session id , corresponding location
log1
, logentrytime
log2
when event
init
, exit
. query right not return data log2
, part log1
returning data.
what problem , how fix it?
Comments
Post a Comment