elasticsearch - Merge buckets with same name ignoring case -
there level analyzed field values "info", "warn", "error"...
sometimes values can lowercased "info".
when simple terms aggregation in kibana 2 buckets created: 1 "info" , "info".
i've specified case_insensitive flag without success.
is possible behavior without touching tokenization of field @ elasticsearch level?
you can achieve through scripting. though scripting not recommended makes query slow, if want result without touching tokenization can use below query.
{ "aggs" : { "group_level_ignore_case" :{ "terms" : { "script" : "doc['level'].value.tolowercase()" } } } } hope helps.
Comments
Post a Comment