This version of the OpenSearch documentation is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.

Reverse nested aggregations

You can aggregate values from nested documents to their parent; this aggregation is called reverse_nested. You can use reverse_nested to aggregate a field from the parent document after grouping by the field from the nested object. The reverse_nested aggregation “joins back” the root page and gets the load_time for each for your variations.

The reverse_nested aggregation is a sub-aggregation inside a nested aggregation. It accepts a single option named path. This option defines how many steps backwards in the document hierarchy OpenSearch takes to calculate the aggregations.

  1. GET logs/_search
  2. {
  3.   "query": {
  4.     "match": { "response": "200" }
  5.   },
  6.   "aggs": {
  7.     "pages": {
  8.       "nested": {
  9.         "path": "pages"
  10.       },
  11.       "aggs": {
  12.         "top_pages_per_load_time": {
  13.           "terms": {
  14.             "field": "pages.load_time"
  15.           },
  16.           "aggs": {
  17.             "comment_to_logs": {
  18.               "reverse_nested": {},
  19.               "aggs": {
  20.                 "min_load_time": {
  21.                   "min": {
  22.                     "field": "pages.load_time"
  23.                   }
  24.                 }
  25.               }
  26.             }
  27.           }
  28.         }
  29.       }
  30.     }
  31.   }
  32. }

copy

Example response

  1. ...
  2. "aggregations" : {
  3.   "pages" : {
  4.     "doc_count" : 2,
  5.     "top_pages_per_load_time" : {
  6.       "doc_count_error_upper_bound" : 0,
  7.       "sum_other_doc_count" : 0,
  8.       "buckets" : [
  9.         {
  10.           "key" : 200.0,
  11.           "doc_count" : 1,
  12.           "comment_to_logs" : {
  13.             "doc_count" : 1,
  14.             "min_load_time" : {
  15.               "value" : null
  16.             }
  17.           }
  18.         },
  19.         {
  20.           "key" : 500.0,
  21.           "doc_count" : 1,
  22.           "comment_to_logs" : {
  23.             "doc_count" : 1,
  24.             "min_load_time" : {
  25.               "value" : null
  26.             }
  27.           }
  28.         }
  29.       ]
  30.     }
  31.   }
  32.  }
  33. }

The response shows the logs index has one page with a load_time of 200 and one with a load_time of 500.