Missing aggregations

If you have documents in your index that don’t contain the aggregating field at all or the aggregating field has a value of NULL, use the missing parameter to specify the name of the bucket such documents should be placed in.

The following example adds any missing values to a bucket named “N/A”:

  1. GET opensearch_dashboards_sample_data_logs/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.     "response_codes": {
  6.       "terms": {
  7.         "field": "response.keyword",
  8.         "size": 10,
  9.         "missing": "N/A"
  10.       }
  11.     }
  12.   }
  13. }

copy

Because the default value for the min_doc_count parameter is 1, the missing parameter doesn’t return any buckets in its response. Set min_doc_count parameter to 0 to see the “N/A” bucket in the response:

  1. GET opensearch_dashboards_sample_data_logs/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.     "response_codes": {
  6.       "terms": {
  7.         "field": "response.keyword",
  8.         "size": 10,
  9.         "missing": "N/A",
  10.         "min_doc_count": 0
  11.       }
  12.     }
  13.   }
  14. }

Example response

  1. ...
  2. "aggregations" : {
  3.   "response_codes" : {
  4.     "doc_count_error_upper_bound" : 0,
  5.     "sum_other_doc_count" : 0,
  6.     "buckets" : [
  7.       {
  8.         "key" : "200",
  9.         "doc_count" : 12832
  10.       },
  11.       {
  12.         "key" : "404",
  13.         "doc_count" : 801
  14.       },
  15.       {
  16.         "key" : "503",
  17.         "doc_count" : 441
  18.       },
  19.       {
  20.         "key" : "N/A",
  21.         "doc_count" : 0
  22.       }
  23.     ]
  24.   }
  25.  }
  26. }