ElasticSearch term aggregation

elasticsearch, elasticsearch-marvel

Solution

Actually you should change your mapping like this

"os_name": {
  "type": "string",
  "fields": {
     "raw": {
        "type": "string",
        "index": "not_analyzed"
     }
  }
},

and your aggs should be changed to:

GET /temp/example/_search
{
  "size": 0,
  "aggs": {
     "OS": {
       "terms": {
           "field": "os_name.raw"
       }
     }
  }
}

Problem

I'm trying to perform a term aggregation using elastic search for the data below with following query, the output breaks the names into tokens (see output below). So I tried mapping the os_name as multi_field and now I am not able to query by it. Is it possible to have index without tokens? such as "Fedora Core"? Query: ``` GET /temp/example/_search { "size": 0, "aggs": { "OS": { "terms": { "field": "os_name" } } } } ``` Data: ``` ... { "_index": "temp", "_type": "example", "_id": "3", "_score": 1, "_source": { "title": "system3", "os_name": "Fedora Core", "os_version": 18 } }, { "_index": "temp", "_type": "example", "_id": "1", "_score": 1, "_source": { "title": "system1", "os_name": "Fedora Core", "os_version": 20 } }, { "_index": "temp", "_type": "example", "_id": "2", "_score": 1, "_source": { "title": "backup", "os_name": "Yellow Dog", "os_version": 6 } } ... ``` Output: ``` ... { "key": "core", "doc_count": 2 }, { "key": "fedora", "doc_count": 2 }, { "key": "dog", "doc_count": 1 }, { "key": "yellow", "doc_count": 1 } ... ``` mapping: ``` PUT /temp { "mappings": { "example": { "properties": { "os_name": { "type": "string" }, "os_version": { "type": "long" }, "title": { "type": "string" } } } } } ```

Original source