Not able to aggregate with multiple terms

General Feedback
1

Hello,

I am stuck at aggregate query.
I have a message, matched_id and host.name field, query works if i do not include message.keyword in aggregation. I cannot seem to group over messages? Please help.

GET /pattern_match-*/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "matched_id": {
              "query": "911"
            }
          }
        },
        {
          "range": {
            "@timestamp": {
              "from": "now-1d",
              "to": "now"
            }
          }
        }
      ]
    }
  },
  "aggregations": {
    "critical_host": {
      "terms": {
        "field": "host.name.keyword"
      },
      "aggregations": {
        "message_info": {
          "terms": {
            "field": "message.keyword"
          },
          "aggregations": {
            "count_of_matched_id": {
              "value_count": {
                "field": "matched_id.keyword"
              }
            }
          }
        }
      }
    }
  }
}

Console:

image
image821×523 104 KB

Index:

image
image710×344 24.5 KB

Discover:

image
image852×154 37.8 KB

Thanks

2

“message” field contains more than 500 characters, could this be the reason for aggregation to not work?

3

Resolved.
It was indeed because it was overlooking keywords above 256 characters.
“ignore_above” : 256
YOu can find it with this: GET /your_indexname/_mapping