Find distinct values in elasticsearch

Question

Elasticsearch 7.10.0

Dynamic Mapping:

{
    "mappings": {
        "dynamic_templates": [{
                "integers": {
                    "match_mapping_type": "long",
                    "mapping": {
                        "type": "integer"
                    }
                }
            },
            {
                "strings": {
                    "match_mapping_type": "string",
                    "mapping": {
                        "type": "text",
                        "fields": {
                          "raw": {
                            "type":  "keyword"
                          }
                        }
                    }
                }
            }
        ]
    }
}

Kibana shows following mapping of the index:

{
"mappings": {
"_doc": {
  "dynamic_templates": [
    {
      "integers": {
        "match_mapping_type": "long",
        "mapping": {
          "type": "integer"
        }
      }
    },
    {
      "strings": {
        "match_mapping_type": "string",
        "mapping": {
          "fields": {
            "raw": {
              "type": "keyword"
            }
          },
          "type": "text"
        }
      }
    }
  ],
  "properties": {
     ....filtered out other properties....
     "Registry": {
      "type": "text",
      "fields": {
        "raw": {
          "type": "keyword"
        }
      }
    },
     ....filtered out other properties....
  }
}

} }

GET /iptree_index_base/_search?filter_path=hits.total.value,took,hits.hits._source.Registry
{
  "aggs": {
    "values": {
      "terms": { "field": "Registry.raw" } 
    }
  },
  "sort" : [
      {"Registry.raw" : {"order" : "asc"}}
   ]
}

Results:

{
  "took" : 8,
  "hits" : {
    "total" : {
      "value" : 19
    },
    "hits" : [
      {
        "_source" : {
          "Registry" : "AFRINIC"
        }
      },
      {
        "_source" : {
          "Registry" : "AFRINIC"
        }
      },
      {
        "_source" : {
          "Registry" : "ARIN"
        }
      },
      {
        "_source" : {
          "Registry" : "ARIN"
        }
      },
      ..Rest of duplicate results filtered out
    ]
  }
}

Desired Results:

{
  "took" : 8,
  "hits" : {
    "total" : {
      "value" : 2
    },
    "hits" : [
      {
        "_source" : {
          "Registry" : "AFRINIC"
        }
      },
      {
        "_source" : {
          "Registry" : "ARIN"
        }
      }
    ]
  }
}

Registry.raw is a keyword. What am I missing?

Answer 1

You're not interested in hits, but in aggregated buckets. So the query you're looking for is this one:

GET /iptree_index_base/_search?filter_path=hits.total.value,took,aggregations.values.buckets.key
{
  "size": 0,
  "aggs": {
    "values": {
      "terms": {
        "field": "Registry.raw",
        "order": {
          "_key": "asc"
        }
      }
    }
  }
}