You should wrap your aggregation by the `nested` aggregation to get access to the nested documents
POST /my-index/_search?filter_path=aggregations
{
"aggs": {
"inside_details": {
"nested": {
"path": "details"
},
"aggs": {
"unique_count": {
"terms": {
"field": "details.elts",
"order": {
"_key": "asc"
}
}
}
}
}
}
}
Response
{
"aggregations" : {
"inside_details" : {
"doc_count" : 2,
"unique_count" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : 1,
"doc_count" : 2
},
{
"key" : 2,
"doc_count" : 2
},
{
"key" : 3,
"doc_count" : 1
},
{
"key" : 4,
"doc_count" : 2
}
]
}
}
}
}
You can do it like this with a `bool/must` inside the `filter` section (since you don't care about the scoring)
{
"query": {
"bool": {
"filter": {
"bool": {
"must": [
{
"script": {
"script": "_source.stream_id.length() == 0"
}
},
{
"term": {
"source_id": "unknown_source"
}
}
]
}
}
}
}
}
or you can also spare two levels and have it all in the query context (even though you don't care about the scoring)
{
"query": {
"bool": {
"must": [
{
"script": {
"script": "_source.stream_id.length() == 0"
}
},
{
"term": {
"source_id": "unknown_source"
}
}
]
}
}
}
