Bucket selector aggregation

Bucket selector aggregation

A parent pipeline aggregation which executes a script which determines whether the current bucket will be retained in the parent multi-bucket aggregation. The specified metric must be numeric and the script must return a boolean value. If the script language is expression then a numeric return value is permitted. In this case 0.0 will be evaluated as false and all other values will evaluate to true.

The bucket_selector aggregation, like all pipeline aggregations, executes after all other sibling aggregations. This means that using the bucket_selector aggregation to filter the returned buckets in the response does not save on execution time running the aggregations.

Syntax

A bucket_selector aggregation looks like this in isolation:

  1. {
  2.   "bucket_selector": {
  3.     "buckets_path": {
  4.       "my_var1": "the_sum",                     
  5.       "my_var2": "the_value_count"
  6.     },
  7.     "script": "params.my_var1 > params.my_var2"
  8.   }
  9. }

Here, my_var1 is the name of the variable for this buckets path to use in the script, the_sum is the path to the metrics to use for that variable.

Table 50. bucket_selector Parameters

Parameter NameDescriptionRequiredDefault Value

script

The script to run for this aggregation. The script can be inline, file or indexed. (see Scripting for more details)

Required

buckets_path

A map of script variables and their associated path to the buckets we wish to use for the variable (see buckets_path Syntax for more details)

Required

gap_policy

The policy to apply when gaps are found in the data (see Dealing with gaps in the data for more details)

Optional

skip

The following snippet only retains buckets where the total sales for the month is more than 200:

  1. POST /sales/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.     "sales_per_month": {
  6.       "date_histogram": {
  7.         "field": "date",
  8.         "calendar_interval": "month"
  9.       },
  10.       "aggs": {
  11.         "total_sales": {
  12.           "sum": {
  13.             "field": "price"
  14.           }
  15.         },
  16.         "sales_bucket_filter": {
  17.           "bucket_selector": {
  18.             "buckets_path": {
  19.               "totalSales": "total_sales"
  20.             },
  21.             "script": "params.totalSales > 200"
  22.           }
  23.         }
  24.       }
  25.     }
  26.   }
  27. }

And the following may be the response:

  1. {
  2.    "took": 11,
  3.    "timed_out": false,
  4.    "_shards": ...,
  5.    "hits": ...,
  6.    "aggregations": {
  7.       "sales_per_month": {
  8.          "buckets": [
  9.             {
  10.                "key_as_string": "2015/01/01 00:00:00",
  11.                "key": 1420070400000,
  12.                "doc_count": 3,
  13.                "total_sales": {
  14.                    "value": 550.0
  15.                }
  16.             },
  17.             {
  18.                "key_as_string": "2015/03/01 00:00:00",
  19.                "key": 1425168000000,
  20.                "doc_count": 2,
  21.                "total_sales": {
  22.                    "value": 375.0
  23.                }
  24.             }
  25.          ]
  26.       }
  27.    }
  28. }

Bucket for 2015/02/01 00:00:00 has been removed as its total sales was less than 200