Docs
Elasticsearch Reference [7.9] » Aggregations » Returning the type of the aggregation
« Aggregation Metadata Indexing aggregation results with transforms »

Returning the type of the aggregationedit

Sometimes you need to know the exact type of an aggregation in order to parse its results. The typed_keys parameter can be used to change the aggregation’s name in the response so that it will be prefixed by its internal type.

Considering the following date_histogram aggregation named requests_over_time which has a sub top_hits aggregation named top_users:

GET /my-index-000001/_search?typed_keys
{
  "aggregations": {
    "requests_over_time": {
      "date_histogram": {
        "field": "@timestamp",
        "calendar_interval": "year"
      },
      "aggregations": {
        "top_users": {
            "top_hits": {
                "size": 1,
                "_source": ["user.id", "http.response.bytes", "message"]
            }
        }
      }
    }
  }
}

In the response, the aggregations names will be changed to respectively date_histogram#requests_over_time and top_hits#top_users, reflecting the internal types of each aggregation:

{
  "aggregations": {
    "date_histogram#requests_over_time": {                    
      "buckets": [
        {
          "key_as_string": "2099-01-01T00:00:00.000Z",
          "key": 4070908800000,
          "doc_count": 5,
          "top_hits#top_users": {                             
                      "hits": {
              "total": {
                "value": 5,
                "relation": "eq"
              },
              "max_score": 1.0,
              "hits": [
                {
                  "_index": "my-index-000001",
                  "_type": "_doc",
                  "_id": "0",
                  "_score": 1.0,
                  "_source": {
                    "user": { "id": "kimchy"},
                    "message": "GET /search HTTP/1.1 200 1070000",
                    "http": { "response": { "bytes": 1070000 } }
                  }
                }
              ]
            }
          }
        }
      ]
    }
  },
  ...
}

The name requests_over_time now contains the date_histogram prefix.

The name top_users now contains the top_hits prefix.

For some aggregations, it is possible that the returned type is not the same as the one provided with the request. This is the case for Terms, Significant Terms and Percentiles aggregations, where the returned type also contains information about the type of the targeted field: lterms (for a terms aggregation on a Long field), sigsterms (for a significant terms aggregation on a String field), tdigest_percentiles (for a percentile aggregation based on the TDigest algorithm).

« Aggregation Metadata Indexing aggregation results with transforms »