Filter aggregation

Filter aggregation

A single bucket aggregation that narrows the set of documents to those that match a query.

Example:

  1. resp = client.search(
  2.     index="sales",
  3.     size="0",
  4.     filter_path="aggregations",
  5.     aggs={
  6.         "avg_price": {
  7.             "avg": {
  8.                 "field": "price"
  9.             }
  10.         },
  11.         "t_shirts": {
  12.             "filter": {
  13.                 "term": {
  14.                     "type": "t-shirt"
  15.                 }
  16.             },
  17.             "aggs": {
  18.                 "avg_price": {
  19.                     "avg": {
  20.                         "field": "price"
  21.                     }
  22.                 }
  23.             }
  24.         }
  25.     },
  26. )
  27. print(resp)
  1. response = client.search(
  2.   index: 'sales',
  3.   size: 0,
  4.   filter_path: 'aggregations',
  5.   body: {
  6.     aggregations: {
  7.       avg_price: {
  8.         avg: {
  9.           field: 'price'
  10.         }
  11.       },
  12.       t_shirts: {
  13.         filter: {
  14.           term: {
  15.             type: 't-shirt'
  16.           }
  17.         },
  18.         aggregations: {
  19.           avg_price: {
  20.             avg: {
  21.               field: 'price'
  22.             }
  23.           }
  24.         }
  25.       }
  26.     }
  27.   }
  28. )
  29. puts response
  1. const response = await client.search({
  2.   index: "sales",
  3.   size: 0,
  4.   filter_path: "aggregations",
  5.   aggs: {
  6.     avg_price: {
  7.       avg: {
  8.         field: "price",
  9.       },
  10.     },
  11.     t_shirts: {
  12.       filter: {
  13.         term: {
  14.           type: "t-shirt",
  15.         },
  16.       },
  17.       aggs: {
  18.         avg_price: {
  19.           avg: {
  20.             field: "price",
  21.           },
  22.         },
  23.       },
  24.     },
  25.   },
  26. });
  27. console.log(response);
  1. POST /sales/_search?size=0&filter_path=aggregations
  2. {
  3.   "aggs": {
  4.     "avg_price": { "avg": { "field": "price" } },
  5.     "t_shirts": {
  6.       "filter": { "term": { "type": "t-shirt" } },
  7.       "aggs": {
  8.         "avg_price": { "avg": { "field": "price" } }
  9.       }
  10.     }
  11.   }
  12. }

The previous example calculates the average price of all sales as well as the average price of all T-shirt sales.

Response:

  1. {
  2.   "aggregations": {
  3.     "avg_price": { "value": 140.71428571428572 },
  4.     "t_shirts": {
  5.       "doc_count": 3,
  6.       "avg_price": { "value": 128.33333333333334 }
  7.     }
  8.   }
  9. }

Use a top-level query to limit all aggregations

To limit the documents on which all aggregations in a search run, use a top-level query. This is faster than a single filter aggregation with sub-aggregations.

For example, use this:

  1. resp = client.search(
  2.     index="sales",
  3.     size="0",
  4.     filter_path="aggregations",
  5.     query={
  6.         "term": {
  7.             "type": "t-shirt"
  8.         }
  9.     },
  10.     aggs={
  11.         "avg_price": {
  12.             "avg": {
  13.                 "field": "price"
  14.             }
  15.         }
  16.     },
  17. )
  18. print(resp)
  1. response = client.search(
  2.   index: 'sales',
  3.   size: 0,
  4.   filter_path: 'aggregations',
  5.   body: {
  6.     query: {
  7.       term: {
  8.         type: 't-shirt'
  9.       }
  10.     },
  11.     aggregations: {
  12.       avg_price: {
  13.         avg: {
  14.           field: 'price'
  15.         }
  16.       }
  17.     }
  18.   }
  19. )
  20. puts response
  1. const response = await client.search({
  2.   index: "sales",
  3.   size: 0,
  4.   filter_path: "aggregations",
  5.   query: {
  6.     term: {
  7.       type: "t-shirt",
  8.     },
  9.   },
  10.   aggs: {
  11.     avg_price: {
  12.       avg: {
  13.         field: "price",
  14.       },
  15.     },
  16.   },
  17. });
  18. console.log(response);
  1. POST /sales/_search?size=0&filter_path=aggregations
  2. {
  3.   "query": { "term": { "type": "t-shirt" } },
  4.   "aggs": {
  5.     "avg_price": { "avg": { "field": "price" } }
  6.   }
  7. }

Instead of this:

  1. resp = client.search(
  2.     index="sales",
  3.     size="0",
  4.     filter_path="aggregations",
  5.     aggs={
  6.         "t_shirts": {
  7.             "filter": {
  8.                 "term": {
  9.                     "type": "t-shirt"
  10.                 }
  11.             },
  12.             "aggs": {
  13.                 "avg_price": {
  14.                     "avg": {
  15.                         "field": "price"
  16.                     }
  17.                 }
  18.             }
  19.         }
  20.     },
  21. )
  22. print(resp)
  1. response = client.search(
  2.   index: 'sales',
  3.   size: 0,
  4.   filter_path: 'aggregations',
  5.   body: {
  6.     aggregations: {
  7.       t_shirts: {
  8.         filter: {
  9.           term: {
  10.             type: 't-shirt'
  11.           }
  12.         },
  13.         aggregations: {
  14.           avg_price: {
  15.             avg: {
  16.               field: 'price'
  17.             }
  18.           }
  19.         }
  20.       }
  21.     }
  22.   }
  23. )
  24. puts response
  1. const response = await client.search({
  2.   index: "sales",
  3.   size: 0,
  4.   filter_path: "aggregations",
  5.   aggs: {
  6.     t_shirts: {
  7.       filter: {
  8.         term: {
  9.           type: "t-shirt",
  10.         },
  11.       },
  12.       aggs: {
  13.         avg_price: {
  14.           avg: {
  15.             field: "price",
  16.           },
  17.         },
  18.       },
  19.     },
  20.   },
  21. });
  22. console.log(response);
  1. POST /sales/_search?size=0&filter_path=aggregations
  2. {
  3.   "aggs": {
  4.     "t_shirts": {
  5.       "filter": { "term": { "type": "t-shirt" } },
  6.       "aggs": {
  7.         "avg_price": { "avg": { "field": "price" } }
  8.       }
  9.     }
  10.   }
  11. }

Use the filters aggregation for multiple filters

To group documents using multiple filters, use the filters aggregation. This is faster than multiple filter aggregations.

For example, use this:

  1. resp = client.search(
  2.     index="sales",
  3.     size="0",
  4.     filter_path="aggregations",
  5.     aggs={
  6.         "f": {
  7.             "filters": {
  8.                 "filters": {
  9.                     "hats": {
  10.                         "term": {
  11.                             "type": "hat"
  12.                         }
  13.                     },
  14.                     "t_shirts": {
  15.                         "term": {
  16.                             "type": "t-shirt"
  17.                         }
  18.                     }
  19.                 }
  20.             },
  21.             "aggs": {
  22.                 "avg_price": {
  23.                     "avg": {
  24.                         "field": "price"
  25.                     }
  26.                 }
  27.             }
  28.         }
  29.     },
  30. )
  31. print(resp)
  1. response = client.search(
  2.   index: 'sales',
  3.   size: 0,
  4.   filter_path: 'aggregations',
  5.   body: {
  6.     aggregations: {
  7.       f: {
  8.         filters: {
  9.           filters: {
  10.             hats: {
  11.               term: {
  12.                 type: 'hat'
  13.               }
  14.             },
  15.             t_shirts: {
  16.               term: {
  17.                 type: 't-shirt'
  18.               }
  19.             }
  20.           }
  21.         },
  22.         aggregations: {
  23.           avg_price: {
  24.             avg: {
  25.               field: 'price'
  26.             }
  27.           }
  28.         }
  29.       }
  30.     }
  31.   }
  32. )
  33. puts response
  1. const response = await client.search({
  2.   index: "sales",
  3.   size: 0,
  4.   filter_path: "aggregations",
  5.   aggs: {
  6.     f: {
  7.       filters: {
  8.         filters: {
  9.           hats: {
  10.             term: {
  11.               type: "hat",
  12.             },
  13.           },
  14.           t_shirts: {
  15.             term: {
  16.               type: "t-shirt",
  17.             },
  18.           },
  19.         },
  20.       },
  21.       aggs: {
  22.         avg_price: {
  23.           avg: {
  24.             field: "price",
  25.           },
  26.         },
  27.       },
  28.     },
  29.   },
  30. });
  31. console.log(response);
  1. POST /sales/_search?size=0&filter_path=aggregations
  2. {
  3.   "aggs": {
  4.     "f": {
  5.       "filters": {
  6.         "filters": {
  7.           "hats": { "term": { "type": "hat" } },
  8.           "t_shirts": { "term": { "type": "t-shirt" } }
  9.         }
  10.       },
  11.       "aggs": {
  12.         "avg_price": { "avg": { "field": "price" } }
  13.       }
  14.     }
  15.   }
  16. }

Instead of this:

  1. resp = client.search(
  2.     index="sales",
  3.     size="0",
  4.     filter_path="aggregations",
  5.     aggs={
  6.         "hats": {
  7.             "filter": {
  8.                 "term": {
  9.                     "type": "hat"
  10.                 }
  11.             },
  12.             "aggs": {
  13.                 "avg_price": {
  14.                     "avg": {
  15.                         "field": "price"
  16.                     }
  17.                 }
  18.             }
  19.         },
  20.         "t_shirts": {
  21.             "filter": {
  22.                 "term": {
  23.                     "type": "t-shirt"
  24.                 }
  25.             },
  26.             "aggs": {
  27.                 "avg_price": {
  28.                     "avg": {
  29.                         "field": "price"
  30.                     }
  31.                 }
  32.             }
  33.         }
  34.     },
  35. )
  36. print(resp)
  1. response = client.search(
  2.   index: 'sales',
  3.   size: 0,
  4.   filter_path: 'aggregations',
  5.   body: {
  6.     aggregations: {
  7.       hats: {
  8.         filter: {
  9.           term: {
  10.             type: 'hat'
  11.           }
  12.         },
  13.         aggregations: {
  14.           avg_price: {
  15.             avg: {
  16.               field: 'price'
  17.             }
  18.           }
  19.         }
  20.       },
  21.       t_shirts: {
  22.         filter: {
  23.           term: {
  24.             type: 't-shirt'
  25.           }
  26.         },
  27.         aggregations: {
  28.           avg_price: {
  29.             avg: {
  30.               field: 'price'
  31.             }
  32.           }
  33.         }
  34.       }
  35.     }
  36.   }
  37. )
  38. puts response
  1. const response = await client.search({
  2.   index: "sales",
  3.   size: 0,
  4.   filter_path: "aggregations",
  5.   aggs: {
  6.     hats: {
  7.       filter: {
  8.         term: {
  9.           type: "hat",
  10.         },
  11.       },
  12.       aggs: {
  13.         avg_price: {
  14.           avg: {
  15.             field: "price",
  16.           },
  17.         },
  18.       },
  19.     },
  20.     t_shirts: {
  21.       filter: {
  22.         term: {
  23.           type: "t-shirt",
  24.         },
  25.       },
  26.       aggs: {
  27.         avg_price: {
  28.           avg: {
  29.             field: "price",
  30.           },
  31.         },
  32.       },
  33.     },
  34.   },
  35. });
  36. console.log(response);
  1. POST /sales/_search?size=0&filter_path=aggregations
  2. {
  3.   "aggs": {
  4.     "hats": {
  5.       "filter": { "term": { "type": "hat" } },
  6.       "aggs": {
  7.         "avg_price": { "avg": { "field": "price" } }
  8.       }
  9.     },
  10.     "t_shirts": {
  11.       "filter": { "term": { "type": "t-shirt" } },
  12.       "aggs": {
  13.         "avg_price": { "avg": { "field": "price" } }
  14.       }
  15.     }
  16.   }
  17. }