I want to do a terms aggregation on two fields. Is it possible to combine these two queries into one? I tried it with the below request is fetching a not properly filtered which is written in include "P_SAL". In the output source prod is displayed with other values also along with P_SAL. I do want to show only P_SAL. Input:
{
"size": 1000,
"query": {
"bool": {
"must": [
{
"match": {
"c_no": {
"query": "3M"
}
}
},
{
"multi_match": {
"query": "joh",
"operator": "and",
"type": "cross_fields",
"tie_breaker": "1.0",
"fields": [
"a_line1",
"a_line2",
"a_line3",
"a_line4",
"a_line5",
"a_line6",
"a_line7",
"i_name"
]
}
}
]
}
},
"aggs": {
"prod": {
"terms": {
"fi": "prod",
"include":[
"P_SAL"
]
},
"aggregations": {
"top_hits": {
"top_hits": {
"sort": [
{
"e_date": {
"order": "desc"
}
}
]
}
}
}
}
}
}