Missing aggregations

If you have documents in your index that don’t contain the aggregating field at all or the aggregating field has a value of NULL, use the missing parameter to specify the name of the bucket such documents should be placed in.

The following example adds any missing values to a bucket named “N/A”:

  1. GET opensearch_dashboards_sample_data_logs/_search
  2. {
  3. "size": 0,
  4. "aggs": {
  5. "response_codes": {
  6. "terms": {
  7. "field": "response.keyword",
  8. "size": 10,
  9. "missing": "N/A"
  10. }
  11. }
  12. }
  13. }

copy

Because the default value for the min_doc_count parameter is 1, the missing parameter doesn’t return any buckets in its response. Set min_doc_count parameter to 0 to see the “N/A” bucket in the response:

  1. GET opensearch_dashboards_sample_data_logs/_search
  2. {
  3. "size": 0,
  4. "aggs": {
  5. "response_codes": {
  6. "terms": {
  7. "field": "response.keyword",
  8. "size": 10,
  9. "missing": "N/A",
  10. "min_doc_count": 0
  11. }
  12. }
  13. }
  14. }

Example response

  1. ...
  2. "aggregations" : {
  3. "response_codes" : {
  4. "doc_count_error_upper_bound" : 0,
  5. "sum_other_doc_count" : 0,
  6. "buckets" : [
  7. {
  8. "key" : "200",
  9. "doc_count" : 12832
  10. },
  11. {
  12. "key" : "404",
  13. "doc_count" : 801
  14. },
  15. {
  16. "key" : "503",
  17. "doc_count" : 441
  18. },
  19. {
  20. "key" : "N/A",
  21. "doc_count" : 0
  22. }
  23. ]
  24. }
  25. }
  26. }