Elastic Search - aggregation group by index

Question

I have some indices with the same data type (same fields). Is there a way to get a max value (for example) of some field in every index?

Assume I have the following data:

index1.some_type:
    {"some_field": 23},
    {"some_field": 14},
    {"some_field": 43}

index2.some_type:
    {"some_field": 11},
    {"some_field": 65},
    {"some_field": 3}

I want to get max value 43 for the first index, and max value 65 for second. Elastic Search allows to do such a thing in one aggregation query?

Answer 1

Yes, definitely you can use the special _index meta field in a terms aggregation and then use the max aggregation on some_field, like this:

curl -XPOST localhost:9200/_search -d '{
  "size": 0,
  "aggs": {
    "byindex": {
      "terms": {
        "field": "_index",
        "size": 100
      },
      "aggs": {
        "max_value": {
          "max": {
            "field": "some_field"
          }
        }
      }
    }
  }
}'