IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Diversified sampler aggregation Filters aggregation »
Elastic Docs ›Elasticsearch Guide [8.11] ›Aggregations ›Bucket aggregations

Filter aggregation

edit

Filter aggregation

edit

A single bucket aggregation that narrows the set of documents to those that match a query.

Example:

resp = client.search(
    index="sales",
    size="0",
    filter_path="aggregations",
    body={
        "aggs": {
            "avg_price": {"avg": {"field": "price"}},
            "t_shirts": {
                "filter": {"term": {"type": "t-shirt"}},
                "aggs": {"avg_price": {"avg": {"field": "price"}}},
            },
        }
    },
)
print(resp)
response = client.search(
  index: 'sales',
  size: 0,
  filter_path: 'aggregations',
  body: {
    aggregations: {
      avg_price: {
        avg: {
          field: 'price'
        }
      },
      t_shirts: {
        filter: {
          term: {
            type: 't-shirt'
          }
        },
        aggregations: {
          avg_price: {
            avg: {
              field: 'price'
            }
          }
        }
      }
    }
  }
)
puts response
POST /sales/_search?size=0&filter_path=aggregations
{
  "aggs": {
    "avg_price": { "avg": { "field": "price" } },
    "t_shirts": {
      "filter": { "term": { "type": "t-shirt" } },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    }
  }
}

The previous example calculates the average price of all sales as well as the average price of all T-shirt sales.

Response:

{
  "aggregations": {
    "avg_price": { "value": 140.71428571428572 },
    "t_shirts": {
      "doc_count": 3,
      "avg_price": { "value": 128.33333333333334 }
    }
  }
}

Use a top-level query to limit all aggregations

edit

To limit the documents on which all aggregations in a search run, use a top-level query. This is faster than a single filter aggregation with sub-aggregations.

For example, use this:

resp = client.search(
    index="sales",
    size="0",
    filter_path="aggregations",
    body={
        "query": {"term": {"type": "t-shirt"}},
        "aggs": {"avg_price": {"avg": {"field": "price"}}},
    },
)
print(resp)
response = client.search(
  index: 'sales',
  size: 0,
  filter_path: 'aggregations',
  body: {
    query: {
      term: {
        type: 't-shirt'
      }
    },
    aggregations: {
      avg_price: {
        avg: {
          field: 'price'
        }
      }
    }
  }
)
puts response
POST /sales/_search?size=0&filter_path=aggregations
{
  "query": { "term": { "type": "t-shirt" } },
  "aggs": {
    "avg_price": { "avg": { "field": "price" } }
  }
}

Instead of this:

resp = client.search(
    index="sales",
    size="0",
    filter_path="aggregations",
    body={
        "aggs": {
            "t_shirts": {
                "filter": {"term": {"type": "t-shirt"}},
                "aggs": {"avg_price": {"avg": {"field": "price"}}},
            }
        }
    },
)
print(resp)
response = client.search(
  index: 'sales',
  size: 0,
  filter_path: 'aggregations',
  body: {
    aggregations: {
      t_shirts: {
        filter: {
          term: {
            type: 't-shirt'
          }
        },
        aggregations: {
          avg_price: {
            avg: {
              field: 'price'
            }
          }
        }
      }
    }
  }
)
puts response
POST /sales/_search?size=0&filter_path=aggregations
{
  "aggs": {
    "t_shirts": {
      "filter": { "term": { "type": "t-shirt" } },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    }
  }
}

Use the filters aggregation for multiple filters

edit

To group documents using multiple filters, use the filters aggregation. This is faster than multiple filter aggregations.

For example, use this:

resp = client.search(
    index="sales",
    size="0",
    filter_path="aggregations",
    body={
        "aggs": {
            "f": {
                "filters": {
                    "filters": {
                        "hats": {"term": {"type": "hat"}},
                        "t_shirts": {"term": {"type": "t-shirt"}},
                    }
                },
                "aggs": {"avg_price": {"avg": {"field": "price"}}},
            }
        }
    },
)
print(resp)
response = client.search(
  index: 'sales',
  size: 0,
  filter_path: 'aggregations',
  body: {
    aggregations: {
      f: {
        filters: {
          filters: {
            hats: {
              term: {
                type: 'hat'
              }
            },
            t_shirts: {
              term: {
                type: 't-shirt'
              }
            }
          }
        },
        aggregations: {
          avg_price: {
            avg: {
              field: 'price'
            }
          }
        }
      }
    }
  }
)
puts response
POST /sales/_search?size=0&filter_path=aggregations
{
  "aggs": {
    "f": {
      "filters": {
        "filters": {
          "hats": { "term": { "type": "hat" } },
          "t_shirts": { "term": { "type": "t-shirt" } }
        }
      },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    }
  }
}

Instead of this:

resp = client.search(
    index="sales",
    size="0",
    filter_path="aggregations",
    body={
        "aggs": {
            "hats": {
                "filter": {"term": {"type": "hat"}},
                "aggs": {"avg_price": {"avg": {"field": "price"}}},
            },
            "t_shirts": {
                "filter": {"term": {"type": "t-shirt"}},
                "aggs": {"avg_price": {"avg": {"field": "price"}}},
            },
        }
    },
)
print(resp)
response = client.search(
  index: 'sales',
  size: 0,
  filter_path: 'aggregations',
  body: {
    aggregations: {
      hats: {
        filter: {
          term: {
            type: 'hat'
          }
        },
        aggregations: {
          avg_price: {
            avg: {
              field: 'price'
            }
          }
        }
      },
      t_shirts: {
        filter: {
          term: {
            type: 't-shirt'
          }
        },
        aggregations: {
          avg_price: {
            avg: {
              field: 'price'
            }
          }
        }
      }
    }
  }
)
puts response
POST /sales/_search?size=0&filter_path=aggregations
{
  "aggs": {
    "hats": {
      "filter": { "term": { "type": "hat" } },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    },
    "t_shirts": {
      "filter": { "term": { "type": "t-shirt" } },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    }
  }
}
« Diversified sampler aggregation Filters aggregation »