Here is some sample data: PUT index1
PUT index1/type1/_mapping { "type1": { "properties": { "kvp": { "type": "nested", "properties": { "key": { "type": "string" }, "value": { "type": "string" } } } } } } POST index1/type1 { "kvp": [ { "key": "key1", "value": "value1" } ] } POST index1/type1 { "kvp": [ { "key": "key1", "value": "value1" }, { "key": "key1", "value": "value2" }, { "key": "key2", "value": "value1" }, { "key": "key2", "value": "value2" } ] } The result I'd like combines the fields "kvp.key" and "kvp.value": key1 - value1: DocCount = 2 key1 - value2: DocCount = 1 key2 - value2: DocCount = 1 I'm starting to think that I need to re-index the data and combine the "kvp.key" and "kvp.value" fields into a single field so that I can aggregate on it. On Friday, October 24, 2014 2:17:04 PM UTC-5, Jay Hilden wrote: > > I have an ES type with a nested KeyValuePair type. What I'm trying to do > is a terms aggregation on both the key and value fields such that I'd get > the following results: > > Key1 - Value1: DocCount = 10 > Key1 - Value2: DocCount = 9 > Key2 - Value3: DocCount = 4 > > Here is my mapping: > { > "index123" : { > "mappings" : { > "type123" : { > "properties" : { > "authEventID" : { > "type" : "long" > }, > "authInput" : { > "properties" : { > "uIDExtensionFields" : { > "type" : "nested", > "properties" : { > "key" : { > "type" : "string" > }, > "value" : { > "type" : "string" > } > } > } > } > } > } > } > } > } > } > > Is there a way to do this? > > Thank you. > -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/d9db4ea8-68af-4cc5-a6dc-876f218b58f7%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.