Как сделать Elasti c Search API (Query) с подсчетом полей и подфайлов

Question

Я хочу получить количество (SUSPECT и CLEAR) каждого состояния в API с использованием Elasti c Запрос на поиск - Данные внутри Elasti c Поиск выглядит как - Пример данных-

{
        "_index" : "index_name"
        "_type" : "_doc",
        "_id" : "id1",
        "_score" : 1.0,
        "_source" : {
          "slflag" : "SUSPECT",
          "state_name" : "UTTAR PRADESH",
        } 



{
        "_index" : "index_name",
        "_type" : "_doc",
        "_id" : id2",
        "_score" : 1.0,
        "_source" : {
          "slflag" : "CLEAR",
          "state_name" : "UTTAR PRADESH",
        }

{
        "_index" : "index_name"
        "_type" : "_doc",
        "_id" : "id3",
        "_score" : 1.0,
        "_source" : {
          "slflag" : "SUSPECT",
          "state_name" : "Delhi",
        } 



{
        "_index" : "index_name",
        "_type" : "_doc",
        "_id" : id4",
        "_score" : 1.0,
        "_source" : {
          "slflag" : "CLEAR",
          "state_name" : "Madhya Pradesh",
        }


{
        "_index" : "index_name"
        "_type" : "_doc",
        "_id" : "id5",
        "_score" : 1.0,
        "_source" : {
          "slflag" : "SUSPECT",
          "state_name" : "Rajasthan",
        } 



{
        "_index" : "index_name",
        "_type" : "_doc",
        "_id" : id6",
        "_score" : 1.0,
        "_source" : {
          "slflag" : "CLEAR",
          "state_name" : "Bihar",
        }

Поля are - state_name, slflag В поле slflag у нас есть две категории - «SUSPECT» и «CLEAR»

Я хочу сделать запрос, чтобы получить такие результаты -

    {
        "stateName": "UTTAR PRADESH",
        "clear": 688,
        "suspect": 182
    },
    {
        "stateName": "Bihar",
        "clear": 398456,
        "suspect": 117110
    },
    {
        "stateName": "Rajasthan",
        "clear": 688,
        "suspect": 182
    },
    {
        "stateName": "Delhi",
        "clear": 12096,
        "suspect": 984
    }

Не знаю умеют считать slflag для каждого состояния.

Заранее спасибо.

Получить / индекс-

{
  "index" : {
    "aliases" : { },
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "slflag" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "state_name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "wl_d_ind" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    },
    "settings" : {
      "index" : {
        "creation_date" : "1587554261571",
        "number_of_shards" : "1",
        "number_of_replicas" : "1",
        "uuid" : "zFKQmxyTSsyoVLRoCC_3IA",
        "version" : {
          "created" : "7060199"
        },
        "provided_name" : "index"
      }
    }
  }
}

Я пробовал ниже-

GET /index/_search
{
  "size": 0,
  "aggs": {
    "states": {
      "terms": {
        "field": "state_name.keyword",
        "size": 100
      },
      "aggs": {
        "flag": {
          "terms": {
            "field": "slflag.keyword"
          }
        }
      }
    }
  }
}

Выше результатов в-

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "states" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "UTTAR PRADESH",
          "doc_count" : 5403369,
          "flag" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "CLEAR",
                "doc_count" : 4540278
              },
              {
                "key" : "SUSPECT",
                "doc_count" : 863091
              }
            ]
          }
        },
        {
          "key" : "RAJASTHAN",
          "doc_count" : 2239768,
          "flag" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "CLEAR",
                "doc_count" : 1866196
              },
              {
                "key" : "SUSPECT",
                "doc_count" : 373572
              }
            ]
          }
        },
        {
          "key" : "GOA",
          "doc_count" : 12,
          "flag" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "CLEAR",
                "doc_count" : 12
              }
            ]
          }
        }
      ]
    }
  }
}

Answer 1

Сначала необходимо агрегировать на stateName, а затем на slflag, например:

GET index_name/_search?filter_path=**.key,**.doc_count
{
  "size": 0,
  "aggs": {
    "states": {
      "terms": {
        "field": "state_name.keyword",
        "size": 100
      },
      "aggs": {
        "flag": {
          "terms": {
            "field": "slflag.keyword"
          }
        }
      }
    }
  }
}