Elastic Avg. Aggregation in Bool query

user_14118943 0
Viewed 546

In Elastic, I am trying to do average aggregation on bool query filter. But I am getting unable to parse BaseAggregationBuilder with name [query]: parser not found.

My Objective :

  1. Filter the processName : AddCustomer and messageType : Response documents.
  2. Find average response time for the filtered data using the field elapsed_time

My code

{
  "from": 0,
  "size": 20,
  "aggs": {
    "filtered_elapsed_time": {
        "query": {
            "bool": {
              "should": [
                {
                  "bool": {
                    "must": [
                      {
                        "match": {
                          "processName": "AddCustomer"
                        }
                      },
                      {
                        "match": {
                          "messageType": "Response"
                        }
                      }
                    ]
                  }
                }
              ]
            }       
      },
      "aggs": {
        "avg_et": {
          "avg": {
            "field": "elapsed_time"
          }
        }
      }
    }
  }
}

Error Response

{
  "error": {
    "root_cause": [
      {
        "type": "named_object_not_found_exception",
        "reason": "[6:18] unable to parse BaseAggregationBuilder with name [query]: parser not found"
      }
    ],
    "type": "named_object_not_found_exception",
    "reason": "[6:18] unable to parse BaseAggregationBuilder with name [query]: parser not found"
  },
  "status": 400
}
elasticsearch
1 Answers

Adding a working example with index data, search query, and search result

Index Data:

{
  "processName":"AddCustomer",
  "messageType":"Response",
   "elapsed_time":20
}
{
  "processName":"AddCustomer",
  "messageType":"Response",
   "elapsed_time":10
}

Search Query:

{                   <-- note this
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "must": [
              {
                "match": {
                  "processName": "AddCustomer"
                }
              },
              {
                "match": {
                  "messageType": "Response"
                }
              }
            ]
          }
        }
      ]
    }
  },
  "aggs": {
    "avg_et": {
      "avg": {
        "field": "elapsed_time"
      }
    }
  }
}

Search Result:

"hits": [
      {
        "_index": "64444060",
        "_type": "_doc",
        "_id": "1",
        "_score": 0.36464313,
        "_source": {
          "processName": "AddCustomer",
          "messageType": "Response",
          "elapsed_time": 10
        }
      },
      {
        "_index": "64444060",
        "_type": "_doc",
        "_id": "2",
        "_score": 0.36464313,
        "_source": {
          "processName": "AddCustomer",
          "messageType": "Response",
          "elapsed_time": 20
        }
      }
    ]
  },
  "aggregations": {
    "avg_et": {
      "value": 15.0        <-- note this
    }
  }

Update 1:

Your search query will also work, by just replacing query with filter keyword

If you are using Filter aggregation to narrow down the current aggregation context to a specific set of documents, then the modified search query will be:

{
  "from": 0,
  "size": 20,
  "aggs": {
    "filtered_elapsed_time": {
      "filter": {               <-- note this
        "bool": {
          "should": [
            {
              "bool": {
                "must": [
                  {
                    "match": {
                      "processName": "AddCustomer"
                    }
                  },
                  {
                    "match": {
                      "messageType": "Response"
                    }
                  }
                ]
              }
            }
          ]
        }
      },
      "aggs": {
        "avg_et": {
          "avg": {
            "field": "elapsed_time"
          }
        }
      }
    }
  }
}
user_103487580
Related