multi value nested field Aggregation in elasticsearch

Question

I meet a quite special problem when using aggregation on a multi value and nested filed in elasticsearch 5.6, and my index mapping is below:

{
"my_index": {
  "mappings": {
    "my_type": {
      "properties": {
        "my_field": {
          "type": "nested",
          "properties": {
            "name": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
             }
           },
           "country": {
             "type": "text",
             "fields": {
               "keyword": {
                 "type": "keyword",
                 "ignore_above": 256
               }
             }
           },
         }
       }
     }
   }
 }
}

and my data is like this :

"my_field": [
  {"name": "apple", "country": "USA"},
  {"name": "alibaba", "country": "CHINA"}
]

the requirement is that: I get a query word e.g. apple, and I use this query word to search on filed name, finally , I want to aggregation on country whose name is the query word apple. my query shows below:

{"query": {
"nested": {"path": "my_field", "query": {"bool": {"should": [{"match": {"my_field.name.keyword": "apple"}}]}}}},
 "aggs": {"m_agg": {"nested": {"path": "my_field"},
                    "aggs": {"m1_agg": {"terms": {"field": "my_field.country.keyword"}}}}}}

so the input is apple, and the expect result is

"aggregations" : {
"m_agg" : {
  "doc_count" : 1,
  "m1_agg" : {
    "doc_count_error_upper_bound" : 0,
    "sum_other_doc_count" : 0,
    "buckets" : [
      {
        "key" : "USA",
        "doc_count" : 1
      }
    ]
  }
}
}

but the elasticsearch returns the result :

"aggregations" : {
"m_agg" : {
  "doc_count" : 2,
  "m1_agg" : {
    "doc_count_error_upper_bound" : 0,
    "sum_other_doc_count" : 0,
    "buckets" : [
      {
        "key" : "USA",
        "doc_count" : 1
      },
      {
        "key" : "CHINA",
        "doc_count" : 1
      }
    ]
  }
}
}

How to change the query DSL, to get the expect result?

Answer 1

In case of nested fields, the query section will not affect the aggregations section.

To solve it, try this:

{
  "size": 0,
  "aggregations": {
    "nested_agg": {
      "nested": {
        "path": "name"
      },
      "aggregations": {
        "bool_agg": {
          "filter": {
            "bool": {
              "must": [
                {
                  "term": {
                    "my_field.name.keyword": "apple"
                  }
                }
              ]
            }
          },
          "aggregations": {
            "m_agg": {
              "nested": {
                "path": "my_field"
              },
              "aggregations": {
                "m1_agg": {
                  "terms": {
                    "field": "my_field.country.keyword"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

See Nested Aggregation and Filter Aggregation

Answer 2

If you need to apply aggregation on specific filtered values. You must use filters inside the aggregation.

In Elastic the query/filters and aggregation wrote separately will be resulted separately without dependent on each other.