Does Elasticsearch support group by (collapse) the documents, after retrieving inner_hits?

Viewed 15

I'm trying to retrieve only the documents (inner_hits) with the specific keyword and then trying to group the documents based on a certain field (collapse).

{
"_source": false,
"query": {
    "bool": {
        "filter": [
            {
                "range": {
                    "alert_docs_count": {
                        "gt": 0
                    }
                }
            },
            {
                "nested": {
                    "path": "alert_docs",
                    "query": {
                        "terms": {
                            "alert_docs.tags.keyword": [
                                "anonymous_login_detected"
                            ]
                        }
                    },
                    "inner_hits": {}
                }
            }
        ]
    }
},
"collapse": {
    "field": "alert_name.keyword",
    "inner_hits": {
        "size": 1000,
        "name": "alert_name",
        "_source": [
            "alert_name",
            "alert_docs",
            "alert_time"
        ],
        "sort": [
            {
                "alert_time": "desc"
            }
        ]
    }
}

}

0 Answers
Related