382 lines
11 KiB
Plaintext
382 lines
11 KiB
Plaintext
[[search-field-stats]]
|
|
== Field stats API
|
|
|
|
experimental[]
|
|
|
|
The field stats api allows one to find statistical properties of a field
|
|
without executing a search, but looking up measurements that are natively
|
|
available in the Lucene index. This can be useful to explore a dataset which
|
|
you don't know much about. For example, this allows creating a histogram
|
|
aggregation with meaningful intervals based on the min/max range of values.
|
|
|
|
For the following examples, lets assume the following indexed data:
|
|
|
|
[source,js]
|
|
-------------------------------------------------
|
|
PUT /github/user/1?refresh
|
|
{
|
|
"user": "kimchy",
|
|
"project": "elasticsearch",
|
|
"rating": "great project"
|
|
}
|
|
|
|
PUT /twitter/tweet/1?refresh
|
|
{
|
|
"user": "kimchy",
|
|
"message": "you know, for search",
|
|
"rating": 10
|
|
}
|
|
------------------------------------------------
|
|
// CONSOLE
|
|
// TESTSETUP
|
|
|
|
|
|
The field stats api by defaults executes on all indices, but can execute on
|
|
specific indices too.
|
|
|
|
All indices:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
GET /_field_stats?fields=rating
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
|
|
Specific indices:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
GET /twitter,github/_field_stats?fields=rating
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
|
|
Supported request options:
|
|
|
|
[horizontal]
|
|
`fields`:: A list of fields to compute stats for. The field name supports wildcard notation. For example, using `text_*`
|
|
will cause all fields that match the expression to be returned.
|
|
`level`:: Defines if field stats should be returned on a per index level or on a
|
|
cluster wide level. Valid values are `indices` and `cluster` (default).
|
|
|
|
Alternatively the `fields` option can also be defined in the request body:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
POST /_field_stats?level=indices
|
|
{
|
|
"fields" : ["rating"]
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
|
|
This is equivalent to the previous request.
|
|
|
|
[float]
|
|
=== Field statistics
|
|
|
|
The field stats api is supported on string based, number based and date based fields and can return the following statistics per field:
|
|
|
|
[horizontal]
|
|
`max_doc`::
|
|
|
|
The total number of documents.
|
|
|
|
`doc_count`::
|
|
|
|
The number of documents that have at least one term for this field, or -1 if
|
|
this measurement isn't available on one or more shards.
|
|
|
|
`density`::
|
|
|
|
The percentage of documents that have at least one value for this field. This
|
|
is a derived statistic and is based on the `max_doc` and `doc_count`.
|
|
|
|
`sum_doc_freq`::
|
|
|
|
The sum of each term's document frequency in this field, or -1 if this
|
|
measurement isn't available on one or more shards.
|
|
Document frequency is the number of documents containing a particular term.
|
|
|
|
`sum_total_term_freq`::
|
|
|
|
The sum of the term frequencies of all terms in this field across all
|
|
documents, or -1 if this measurement isn't available on one or more shards.
|
|
Term frequency is the total number of occurrences of a term in a particular
|
|
document and field.
|
|
|
|
`is_searchable`
|
|
|
|
True if any of the instances of the field is searchable, false otherwise.
|
|
|
|
`is_aggregatable`
|
|
|
|
True if any of the instances of the field is aggregatable, false otherwise.
|
|
|
|
`min_value`::
|
|
|
|
The lowest value in the field.
|
|
|
|
`min_value_as_string`::
|
|
|
|
The lowest value in the field represented in a displayable form. All fields,
|
|
but string fields returns this. (since string fields, represent values already as strings)
|
|
|
|
`max_value`::
|
|
|
|
The highest value in the field.
|
|
|
|
`max_value_as_string`::
|
|
|
|
The highest value in the field represented in a displayable form. All fields,
|
|
but string fields returns this. (since string fields, represent values already as strings)
|
|
|
|
NOTE: Documents marked as deleted (but not yet removed by the merge process)
|
|
still affect all the mentioned statistics.
|
|
|
|
[float]
|
|
=== Cluster level field statistics example
|
|
|
|
Request:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
GET /_field_stats?fields=rating,user,project,message
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
|
|
Response:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
"_shards": {
|
|
"total": 10,
|
|
"successful": 10,
|
|
"failed": 0
|
|
},
|
|
"indices": {
|
|
"_all": { <1>
|
|
"fields": {
|
|
"project": {
|
|
"max_doc": 1,
|
|
"doc_count": 1,
|
|
"density": 100,
|
|
"sum_doc_freq": 1,
|
|
"sum_total_term_freq": 1,
|
|
"searchable": true,
|
|
"aggregatable": false,
|
|
"min_value": "elasticsearch",
|
|
"max_value": "elasticsearch"
|
|
},
|
|
"message": {
|
|
"max_doc": 1,
|
|
"doc_count": 1,
|
|
"density": 100,
|
|
"sum_doc_freq": 4,
|
|
"sum_total_term_freq": 4,
|
|
"searchable": true,
|
|
"aggregatable": false,
|
|
"min_value": "for",
|
|
"max_value": "you"
|
|
},
|
|
"user": {
|
|
"max_doc": 2,
|
|
"doc_count": 2,
|
|
"density": 100,
|
|
"sum_doc_freq": 2,
|
|
"sum_total_term_freq": 2,
|
|
"searchable": true,
|
|
"aggregatable": false,
|
|
"min_value": "kimchy",
|
|
"max_value": "kimchy"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"conflicts": {
|
|
"rating": "Field [rating] of type [whole-number] conflicts with existing field of type [text] in other index." <2>
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// TESTRESPONSE
|
|
|
|
<1> The `_all` key indicates that it contains the field stats of all indices in the cluster.
|
|
|
|
<2> When using the cluster level field statistics it is possible to have conflicts if the same field is used in
|
|
different indices with incompatible types. For instance a field of type `long` is not compatible with a field of
|
|
type `float` or `string`. A section named `conflicts` is added to the response if one or more conflicts are raised.
|
|
It contains all the fields with conflicts and the reason of the incompatibility.
|
|
|
|
[float]
|
|
==== Indices level field statistics example
|
|
|
|
Request:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
GET /_field_stats?fields=rating,user,project,message&level=indices
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
|
|
Response:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
"_shards": {
|
|
"total": 10,
|
|
"successful": 10,
|
|
"failed": 0
|
|
},
|
|
"indices": {
|
|
"github": {
|
|
"fields": {
|
|
"rating": {
|
|
"max_doc": 1,
|
|
"doc_count": 1,
|
|
"density": 100,
|
|
"sum_doc_freq": 2,
|
|
"sum_total_term_freq": 2,
|
|
"searchable": true,
|
|
"aggregatable": false,
|
|
"min_value": "great",
|
|
"max_value": "project"
|
|
},
|
|
"project": {
|
|
"max_doc": 1,
|
|
"doc_count": 1,
|
|
"density": 100,
|
|
"sum_doc_freq": 1,
|
|
"sum_total_term_freq": 1,
|
|
"searchable": true,
|
|
"aggregatable": false,
|
|
"min_value": "elasticsearch",
|
|
"max_value": "elasticsearch"
|
|
},
|
|
"user": {
|
|
"max_doc": 1,
|
|
"doc_count": 1,
|
|
"density": 100,
|
|
"sum_doc_freq": 1,
|
|
"sum_total_term_freq": 1,
|
|
"searchable": true,
|
|
"aggregatable": false,
|
|
"min_value": "kimchy",
|
|
"max_value": "kimchy"
|
|
}
|
|
}
|
|
},
|
|
"twitter": {
|
|
"fields": {
|
|
"rating": {
|
|
"max_doc": 1,
|
|
"doc_count": 1,
|
|
"density": 100,
|
|
"sum_doc_freq": -1,
|
|
"sum_total_term_freq": 1,
|
|
"searchable": true,
|
|
"aggregatable": true,
|
|
"min_value": 10,
|
|
"min_value_as_string": "10",
|
|
"max_value": 10,
|
|
"max_value_as_string": "10"
|
|
},
|
|
"message": {
|
|
"max_doc": 1,
|
|
"doc_count": 1,
|
|
"density": 100,
|
|
"sum_doc_freq": 4,
|
|
"sum_total_term_freq": 4,
|
|
"searchable": true,
|
|
"aggregatable": false,
|
|
"min_value": "for",
|
|
"max_value": "you"
|
|
},
|
|
"user": {
|
|
"max_doc": 1,
|
|
"doc_count": 1,
|
|
"density": 100,
|
|
"sum_doc_freq": 1,
|
|
"sum_total_term_freq": 1,
|
|
"searchable": true,
|
|
"aggregatable": false,
|
|
"min_value": "kimchy",
|
|
"max_value": "kimchy"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// TESTRESPONSE
|
|
<1> The `stack` key means it contains all field stats for the `stack` index.
|
|
|
|
[float]
|
|
=== Field stats index constraints
|
|
|
|
Field stats index constraints allows to omit all field stats for indices that don't match with the constraint. An index
|
|
constraint can exclude indices' field stats based on the `min_value` and `max_value` statistic. This option is only
|
|
useful if the `level` option is set to `indices`.
|
|
|
|
For example index constraints can be useful to find out the min and max value of a particular property of your data in
|
|
a time based scenario. The following request only returns field stats for the `answer_count` property for indices
|
|
holding questions created in the year 2014:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
POST /_field_stats?level=indices
|
|
{
|
|
"fields" : ["rating"], <1>
|
|
"index_constraints" : { <2>
|
|
"creation_date" : { <3>
|
|
"max_value" : { <4>
|
|
"gte" : "2014-01-01T00:00:00.000Z"
|
|
},
|
|
"min_value" : { <4>
|
|
"lt" : "2015-01-01T00:00:00.000Z"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
|
|
<1> The fields to compute and return field stats for.
|
|
<2> The set index constraints. Note that index constrains can be defined for fields that aren't defined in the `fields` option.
|
|
<3> Index constraints for the field `creation_date`.
|
|
<4> Index constraints on the `max_value` and `min_value` property of a field statistic.
|
|
|
|
For a field, index constraints can be defined on the `min_value` statistic, `max_value` statistic or both.
|
|
Each index constraint support the following comparisons:
|
|
|
|
[horizontal]
|
|
`gte`:: Greater-than or equal to
|
|
`gt`:: Greater-than
|
|
`lte`:: Less-than or equal to
|
|
`lt`:: Less-than
|
|
|
|
Field stats index constraints on date fields optionally accept a `format` option, used to parse the constraint's value.
|
|
If missing, the format configured in the field's mapping is used.
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
POST /_field_stats?level=indices
|
|
{
|
|
"fields" : ["rating"],
|
|
"index_constraints" : {
|
|
"creation_date" : {
|
|
"max_value" : {
|
|
"gte" : "2014-01-01",
|
|
"format" : "date_optional_time" <1>
|
|
},
|
|
"min_value" : {
|
|
"lt" : "2015-01-01",
|
|
"format" : "date_optional_time"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
<1> Custom date format
|