Elasticsearch calc sum for 2 fields according to third distinct field

73 views Asked by At

I have in index something like this:

{
  "entity-type": "document",
  "path": "/Root/Users/1234567890/id/pass",
  "properties": {
    "file:content": {
      "name": "foto",
      "digest": "5858ec2a5f0fac7178e6e1136b196c3c",
      "length": "11021"
    },
    "files:files": [
      {
        "file": {
          "name": "foto1",
          "digest": "c4406245aff7d2112a9f46b921ada2d9",
          "length": "37334"
        }
      },
      {
        "file": {
          "name": "foto2",
          "digest": "5858ec2a5f0fac7178e6e1136b196c3c",
          "length": "11021"
        }
      },
      {
        "file": {
          "name": "foto3",
          "digest": "c4406245aff7d2112a9f46b921ada2d9",
          "length": "37334"
        }
      }
    ]
  }
}

What i need to get in result - size of all files distinct by 'digest' field in specific 'path':

Sum = properties.file:content.length + properties.files:files[*].file.length

For this doc its 11021+37334=48355.

But I need this Sum for whole index, where could be files with same digest like in this doc. As you can see there are many troubles: filter, array, sum, distinct, colon in fields name

I just start my way, so here`s what I have now:

{
  "query": {
    "bool": {
      "must": {
        "match_all": {}
      },
      "must_not": [ ],
      "filter": [ { "term": { "path@level1": "Users"}}]             
    }
  },
  "size": 0,
  "aggs": {"size": {"sum": {"field": "files:files.file.length"}}}
}

"must_not": [ ] - just for futures additional selections. As I understand, now I get sum of all files including double.

Thanks to all for the support)

0

There are 0 answers