Find different values, not single values ​​in elasticsearch

Question

Elasticsearch documentation suggests * what is their piece of code

* documentation corrected

GET /cars/transactions/_search?search_type=count { "aggs": { "distinct_colors": { "cardinality": { "field": "color" } } } } 

matches SQL query

 SELECT DISTINCT(color) FROM cars 

but actually it matches

 SELECT COUNT(DISTINCT(color)) FROM cars 

I do not want to know how many different values ​​I have, but what are the different values. Does anyone know how to achieve this?

Answer 1

Use the aggregation of terms in the color field. And you need to pay attention to how this field is analyzed, in which you want to get various values, that is, you need to make sure that you did not specify it when indexing, otherwise each record in the aggregation will be a different term that is part of the contents of the field.

If you still want tokenization and use terms aggregation, you can look at the index type not_analyzed for this field and possibly use several fields .

Summary of Terms for Cars:

 GET /cars/transactions/_search?search_type=count { "aggs": { "distinct_colors": { "terms": { "field": "color", "size": 1000 } } } } 

Answer 2

To update an excellent answer from Andrei Stefan, we need to say that the search_type=count request parameter is no longer supported in Elasticsearch 5. A new way to do this is to add "size" : 0 to the body, for example:

 GET /cars/transactions/_search { "size": 0, "aggs": { "distinct_colors": { "terms": { "field": "color", "size": 1000 } } } } 

Answer 3

Personally, both answers were cryptic and hopelessly complicated for me when I wanted to add a few filters.

It was wise for me to go to the Discovery tab and apply the filters that I wanted. Then I saved my search.

Then I created a new bar chart visualization using my saved search. Then I changed the X axis to use term aggregation based on my area of ​​interest (in my case, usernames), and then sort by quantity. Make sure the size is large, such as 500.

You should be able to get the results in tabular form below your chart. Simple and not complicated JSON programming. Just a series of clicks. You can even save the visualization for later.

Answer 4

I kept thousands of telegrams from dozens of groups. I need to be able to call a query with Python to return a unique value for each group.

How should I do it?

My JSON syntax is:

  { "_index": "indexname", "_type": "items", "_id": "726900857_-1001397432653", "_version": 4, "_score": null, "_source": { "chat": { "id": -7383729824, <=== THIS IS THE VALUE I NEED TO RETURN 

How to request each unique value and return it?

thank