I am able to run below query which is giving response as total of two match_phrase.
Inserting dummy data as below.
POST /mod1/_bulk { "index" : { } } { "msg": "BA1" } { "index" : { } } { "msg": "BA2" } { "index" : { } } { "msg": "BA2" } { "index" : { } } { "msg": "BA1" } { "index" : { } } { "msg": "BA2" } { "index" : { } } { "msg": "BA1" } { "index" : { } } { "msg": "BA1" } { "index" : { } } Request -
GET mod1/_search { "size": 0, "query": { "bool": { "should": [ { "match_phrase": { "msg": "BA1" } }, { "match_phrase": { "msg": "BA2" } } ] } } } Response -
{ "took" : 0, "timed_out" : false, "_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 7, "relation" : "eq" }, "max_score" : null, "hits" : [ ] } } Getting response as 7, because BA1 is 4 and BA2 is 3, so it is giving sum of two match_phrase, How can I get response as below i.e individual output of two match_phrase?
. . "BA1" "hits" : { "total" : { "value" : 4, . . "BA2" "hits" : { "total" : { "value" : 3, Thanks,
keywordfield; then a simpletermsaggregation would do.