Show all Elasticsearch aggregate results / buckets, not just 10

Question

I am trying to list all the buckets in an aggregation, but it looks like it only shows the first 10.

My search:

curl -XPOST "http://localhost:9200/imoveis/_search?pretty=1" -d' { "size": 0, "aggregations": { "bairro_count": { "terms": { "field": "bairro.raw" } } } }' 

Return:

 { "took" : 2, "timed_out" : false, "_shards" : { "total" : 5, "successful" : 5, "failed" : 0 }, "hits" : { "total" : 16920, "max_score" : 0.0, "hits" : [ ] }, "aggregations" : { "bairro_count" : { "buckets" : [ { "key" : "Barra da Tijuca", "doc_count" : 5812 }, { "key" : "Centro", "doc_count" : 1757 }, { "key" : "Recreio dos Bandeirantes", "doc_count" : 1027 }, { "key" : "Ipanema", "doc_count" : 927 }, { "key" : "Copacabana", "doc_count" : 842 }, { "key" : "Leblon", "doc_count" : 833 }, { "key" : "Botafogo", "doc_count" : 594 }, { "key" : "Campo Grande", "doc_count" : 456 }, { "key" : "Tijuca", "doc_count" : 361 }, { "key" : "Flamengo", "doc_count" : 328 } ] } } } 

I have many more than 10 keys for this aggregation. In this example, I would have 145 keys, and I would like to count for each of them. Is there a breakdown into buckets? Can I get them all?

I am using Elasticsearch 1.1.0

Answer 1

The size parameter should be a parameter for an example query terms:

 curl -XPOST "http://localhost:9200/imoveis/_search?pretty=1" -d' { "size": 0, "aggregations": { "bairro_count": { "terms": { "field": "bairro.raw", "size": 0 } } } }' 

As mentioned in the document, it works only for version 1.1.0 and later

Edit

Update response based on @PhaedrusTheGreek comment.

size:0 deprecated in 2.x, due to memory problems caused by your cluster with high field values. Read more about it on gitub here .

It is recommended that you explicitly set a reasonable value for the size number from 1 to 2147483647.

Answer 2

How to show all the buckets?

 { "size": 0, "aggs": { "aggregation_name": { "terms": { "field": "your_field", "size": 10000 } } } } 

The note

• "size":10000 Get a maximum of 10,000 buckets. The default is 10.

• "size":0 As a result, "hits" contains 10 documents by default. We do not need them.

• By default, segments are ordered by doc_count in descending order.

---

Why am I getting Fielddata is disabled on text fields by default error?

Because field data is disabled by default for text fields . Unless you explicitly select a field type mapping, it has default dynamic mappings for string fields .

So instead of writing "field": "your_field" you need to have "field": "your_field.keyword" .

Answer 3

Increase the size (2nd size) to 10,000 in your set of terms, and you will get a container of size 10,000. By default it is set to 10. Also, if you want to see the search results, just set the 1st size to 1, you can see .1 document because ES supports search and aggregation.

 curl -XPOST "http://localhost:9200/imoveis/_search?pretty=1" -d' { "size": 1, "aggregations": { "bairro_count": { "terms": { "field": "bairro.raw", "size": 10000 } } } }' 

Answer 4

But BTW, on https://github.com/elasticsearch/elasticsearch/issues/1776

was closed on June 22nd, my elasticsearch was downloaded and installed before this day, so suppose you can get it if you have the latest version

Answer 5

When the size is 10,000, ES complains that there are too many terms.

A simpler way is to have 2 aggregations, one sorted in ascending order, and the other in descending order, and select the minimum and maximum values, respectively. Something similar can be done below.

 "aggs": { "term_min": { "terms": { "field": "<field_name>", "order": { "_count": "asc" }, "size": 1 } }, "min_count": { "min_bucket": { "buckets_path": "term_min._count" } }, "term_max": { "terms": { "field": "<field_name>", "order": { "_count": "desc" }, "size": 1 } }, "max_count": { "max_bucket": { "buckets_path": "term_max._count" } } }