Elastic Search - Nested aggregation

Question

I would like to form a nested aggregation type query in elastic search. Basically , the nested aggregation is at four levels.

groupId.keyword ---direction --billingCallType --durationCallAnswered

example:

"aggregations": {
        "avgCallDuration": {
            "terms": {
                "field": "groupId.keyword",
                "size": 10000,
                "min_doc_count": 1,
                "shard_min_doc_count": 0,
                "show_term_doc_count_error": false,
                "order": [
                    {
                        "_count": "desc"
                    },
                    {
                        "_key": "asc"
                    }
                ]
            },
            "aggregations": {
                "call_direction": {
                    "terms" : {
                        "field": "direction"
                    },
                    "aggregations": {
                        "call_type" : {
                            "terms": {
                                "field": "billingCallType"
                            },
                        
                            "aggregations": {
                                "avg_value": {
                                    "terms": {
                                        "field": "durationCallAnswered"
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }

This is part of a query . While running this , I am getting the error as
"type": "illegal_argument_exception", "reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [direction] in order to load field data by uninverting the inverted index. Note that this can use significant memory."

Can anyone throw light on this?

Answer 1

Tldr;

As the error state, you are performing an aggregation on a text field, the field direction.

Aggregation are not supported by default on text field, as it is very expensive (cpu and memory wise).

They are 3 solutions to your issue,

1. Change the mapping from text to keyword (will require re indexing, most efficient way to query the data)
2. Change the mapping to add to this field fielddata: true (flexible, but not optimised)
3. Don't do the aggregation on this field :)