Reverse nested aggregations

You can aggregate values from nested documents to their parent; this aggregation is called reverse_nested. You can use reverse_nested to aggregate a field from the parent document after grouping by the field from the nested object. The reverse_nested aggregation “joins back” the root page and gets the load_time for each for your variations.

The reverse_nested aggregation is a sub-aggregation inside a nested aggregation. It accepts a single option named path. This option defines how many steps backwards in the document hierarchy OpenSearch takes to calculate the aggregations.

  1. GET logs/_search
  2. {
  3.   "query": {
  4.     "match": { "response": "200" }
  5.   },
  6.   "aggs": {
  7.     "pages": {
  8.       "nested": {
  9.         "path": "pages"
  10.       },
  11.       "aggs": {
  12.         "top_pages_per_load_time": {
  13.           "terms": {
  14.             "field": "pages.load_time"
  15.           },
  16.           "aggs": {
  17.             "comment_to_logs": {
  18.               "reverse_nested": {},
  19.               "aggs": {
  20.                 "min_load_time": {
  21.                   "min": {
  22.                     "field": "pages.load_time"
  23.                   }
  24.                 }
  25.               }
  26.             }
  27.           }
  28.         }
  29.       }
  30.     }
  31.   }
  32. }

copy

Example response

  1. ...
  2. "aggregations" : {
  3.   "pages" : {
  4.     "doc_count" : 2,
  5.     "top_pages_per_load_time" : {
  6.       "doc_count_error_upper_bound" : 0,
  7.       "sum_other_doc_count" : 0,
  8.       "buckets" : [
  9.         {
  10.           "key" : 200.0,
  11.           "doc_count" : 1,
  12.           "comment_to_logs" : {
  13.             "doc_count" : 1,
  14.             "min_load_time" : {
  15.               "value" : null
  16.             }
  17.           }
  18.         },
  19.         {
  20.           "key" : 500.0,
  21.           "doc_count" : 1,
  22.           "comment_to_logs" : {
  23.             "doc_count" : 1,
  24.             "min_load_time" : {
  25.               "value" : null
  26.             }
  27.           }
  28.         }
  29.       ]
  30.     }
  31.   }
  32.  }
  33. }

The response shows the logs index has one page with a load_time of 200 and one with a load_time of 500.