elasticsearch how to find number of occurrences -

i wonder if it's possible convert sql query es query? select top 10 app, cat, count(*) err group app, cat

or in english answering: "show top app, cat , counts", grouping multiple fields , returning name , count.

for aggregating on combination of multiple fields, have use scripting in terms aggregation below:

post <index name>/<type name>/_search?search_type=count {   "aggs": {     "app_cat": {       "terms": {         "script" : "doc['app'].value + '#' + doc['cat'].value",         "size": 10       }     }   } } 

i using # delimiter assuming not present in value of app and/or cat fields. can use other delimiter of choice. you'll response below:

{    "took": 3,    "timed_out": false,    "_shards": {       "total": 5,       "successful": 5,       "failed": 0    },    "hits": {       "total": 10,       "max_score": 0,       "hits": []    },    "aggregations": {       "app_cat": {          "buckets": [             {                "key": "app2#cat2",                "doc_count": 4             },             {                "key": "app1#cat1",                "doc_count": 3             },             {                "key": "app2#cat1",                "doc_count": 2             },             {                "key": "app1#cat2",                "doc_count": 1             }          ]       }    } } 

on client side, can individual values of app , cat fields aggregation response string manipulations.

in newer versions of elasticsearch, scripting disabled default due security reasons. if want enable scripting, read this.