How to create an Elasticsearch filter aggregation which aggregates on two fields?

I have two keyword elastic fields which are IDs. Both fields could contain the same value.

I have been creating a filter aggregation to get the top 10 counts by one of the fields (with some filter applied, which isn't relevant to this question).

I now need to create a filter aggregation to get the top 10 counts based on both of the fields.

So for a given ID '1234', it would be the count of documents where field1 = 1234 OR field2 = 1234. Getting the count for a single ID is easy of course, but is it possible to use two fields in an aggregation like that?

I am using Elasticsearch v7.12.1. I noted that 'combined_fields' was introduced in v7.13 - I don't know if it is relevant at all.

Updated answer

Tldr;

This is not possible via only an aggregation.

You will have to somehow group those terms into a single field.
You could use a runtime field (so you do not need to re index)

Solution

GET /76328180/_search
{
  "size": 0,
  "aggs": {
    "NAME": {
      "terms": {
        "field": "field_agg"
      }
    }
  }
}

But what is field_agg ?

Well in this case:

POST _bulk
{"index":{"_index": "76328180"}}
{"field_1": 1234, "field_2": 234, "field_agg": [1234, 234]}
{"index":{"_index": "76328180"}}
{"field_1": 1234, "field_2": 345, "field_agg": [1234, 345]}
{"index":{"_index": "76328180"}}
{"field_1": 123, "field_2": 1234, "field_agg": [123, 1234]}
{"index":{"_index": "76328180"}}
{"field_1": 234, "field_2": 4567, "field_agg": [234, 4567]}

Initial answer

Tldr;

Sounds like a job for filters aggregation.

Solution

With the following query:

GET /76328180/_search
{
  "size": 0, 
  "aggs": {
    "values": {
      "filters": {
        "filters": {
          "1234": {
            "bool": {
              "should": [
                {
                  "term": {
                    "field_1": 1234
                  }
                },
                {
                  "term": {
                    "field_2": 1234
                  }
                }
              ]
            }
          }
        }
      }
    }
  }
}

Should give you:

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 4,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "values": {
      "buckets": {
        "1234": {
          "doc_count": 3
        }
      }
    }
  }
}

To reproduce:

Set up:

POST _bulk
{"index":{"_index": "76328180"}}
{"field_1": 1234, "field_2": 234}
{"index":{"_index": "76328180"}}
{"field_1": 1234, "field_2": 345}
{"index":{"_index": "76328180"}}
{"field_1": 123, "field_2": 1234}
{"index":{"_index": "76328180"}}
{"field_1": 234, "field_2": 4567}