Filters aggregations

A filters aggregation is the same as the filter aggregation, except that it lets you use multiple filter aggregations. While the filter aggregation results in a single bucket, the filters aggregation returns multiple buckets, one for each of the defined filters.

To create a bucket for all the documents that didn’t match the any of the filter queries, set the other_bucket property to true:

  1. GET opensearch_dashboards_sample_data_logs/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.     "200_os": {
  6.       "filters": {
  7.         "other_bucket": true,
  8.         "filters": [
  9.           {
  10.             "term": {
  11.               "response.keyword": "200"
  12.             }
  13.           },
  14.           {
  15.             "term": {
  16.               "machine.os.keyword": "osx"
  17.             }
  18.           }
  19.         ]
  20.       },
  21.       "aggs": {
  22.         "avg_amount": {
  23.           "avg": {
  24.             "field": "bytes"
  25.           }
  26.         }
  27.       }
  28.     }
  29.   }
  30. }

copy

Example response

  1. ...
  2. "aggregations" : {
  3.   "200_os" : {
  4.     "buckets" : [
  5.       {
  6.         "doc_count" : 12832,
  7.         "avg_amount" : {
  8.           "value" : 5897.852711970075
  9.         }
  10.       },
  11.       {
  12.         "doc_count" : 2825,
  13.         "avg_amount" : {
  14.           "value" : 5620.347256637168
  15.         }
  16.       },
  17.       {
  18.         "doc_count" : 1017,
  19.         "avg_amount" : {
  20.           "value" : 3247.0963618485744
  21.         }
  22.       }
  23.     ]
  24.   }
  25.  }
  26. }