Exists Query not returning result

Question

I want to check all the values presented in failure_error_code. If I remove exists from the query, it is working, but it is returning meta fields which I don't want. In the last 90 days, I have 29344 documents, but it is showing only a few documents.

Does anyone know how to select all values for a specific field without showing meta fields?

GET rds_database-*/_search
{
  "fields": [
    "failure_error_code.keyword"
  ],
  "query": {
    "bool": {
      "filter": [
        {
            "term":{
              "status.keyword":"F"
              
            }
            },
            {
              "exists": {
                "field": "failure_error_code.keyword"
              }
            },
            {
            "range":
            {
              "@timestamp":
              {
                "gte":"now-1y/d",
                "lte":"now/d"
              }
            }
            }
      ]
    }
  }
}

Answer 1

You can use terms aggregation for that.

A multi-bucket value source based aggregation where buckets are dynamically built - one per unique value.

PUT test_term_aggs/_doc/1
{
  "failure_error_code": "404"
}

---

PUT test_term_aggs/_doc/2
{
  "failure_error_code": "402"
}

---

GET test_term_aggs/_search
{
  "size": 0,
  "aggs": {
    "NAME": {
      "terms": {
        "field": "failure_error_code.keyword"
      }
    }
  }
}