Elasticsearch filter buckets count in aggregation

44 Views Asked by At

I have to fetch the categories having zero records in the last two hours .

The query is built to filter records/documents in certain regions , then aggregation is done for the last two hours on category id.

The output for this is as below

{
  "aggregations": {
    "Data_val": {
      "doc_count": 21027297,
      "NAME": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": [
          {
            "key": "1302",
            "doc_count": 0
          },
          {
            "key": "353",
            "doc_count": 0
          },
          {
            "key": "301",
            "doc_count": 0
          },
          {
            "key": "221",
            "doc_count": 10
          }, 
....
}

From the above output i need to fetch keys, having doc_count=0, query is below

GET /category-sale-*/_search?size=100&filter_path=aggregations
{
  "query": {
    "bool": {
      "filter": {
        "bool": {
          "must_not": [
            {
              "bool": {
                "should": [
                  {
                    "match_phrase": {
                      "region_cd": "6"
                    }
                  },
                  {
                    "match_phrase": {
                      "region_cd": "65"
                    }
                  },
                  {
                    "match_phrase": {
                      "region_cd": "62"
                    }
                  }
                ],
                "minimum_should_match": 1
              }
            }
          ]
        }
      }
    }
  },
  "aggs": {
    "Data_val": {
      "filter": {
        "range": {
          "@timestamp": {
            "gte": "now-2h",
            "lte": "now"
          }
        }
      },
      "aggs": {
        "NAME": {
          "terms": {
            "field": "catgy_id",
            "size": 10000,
            "min_doc_count": 0,
            "order": {
              "_count": "asc"
            }
          }
        }
      }
    }
  }
}

Tried to add below aggs section to filter buckets within "Data_val.NAME". However it is failing

"aggs": {
    "filter_zero": {
      "bucket_selector": {
          "buckets_path": {
            "val": "NAME.buckets"
           },
           "script": "val._count==0"
         }
      }
  }

with the below error,

""type": "action_request_validation_exception", "reason": "Validation Failed: 1: No aggregation found for path [NAME.buckets];"

The output have sections NAME.buckets, even tried with Data*val.NAME.buckets as well in the buckets_*path

 "Data_val": {
      "doc_count": 21027297,
      "NAME": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": [
          {
            "key": "1302",
            "doc_count": 0
          },
0

There are 0 best solutions below