IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Diversified sampler aggregation Filters aggregation »
Elastic Docs ›Elasticsearch Guide [8.18] ›Aggregations ›Bucket aggregations

Filter aggregation

edit
A newer version is available. Check out the latest documentation.

Filter aggregation

edit

A single bucket aggregation that narrows the set of documents to those that match a query.

Example:

resp = client.search(
    index="sales",
    size="0",
    filter_path="aggregations",
    aggs={
        "avg_price": {
            "avg": {
                "field": "price"
            }
        },
        "t_shirts": {
            "filter": {
                "term": {
                    "type": "t-shirt"
                }
            },
            "aggs": {
                "avg_price": {
                    "avg": {
                        "field": "price"
                    }
                }
            }
        }
    },
)
print(resp)
response = client.search(
  index: 'sales',
  size: 0,
  filter_path: 'aggregations',
  body: {
    aggregations: {
      avg_price: {
        avg: {
          field: 'price'
        }
      },
      t_shirts: {
        filter: {
          term: {
            type: 't-shirt'
          }
        },
        aggregations: {
          avg_price: {
            avg: {
              field: 'price'
            }
          }
        }
      }
    }
  }
)
puts response
const response = await client.search({
  index: "sales",
  size: 0,
  filter_path: "aggregations",
  aggs: {
    avg_price: {
      avg: {
        field: "price",
      },
    },
    t_shirts: {
      filter: {
        term: {
          type: "t-shirt",
        },
      },
      aggs: {
        avg_price: {
          avg: {
            field: "price",
          },
        },
      },
    },
  },
});
console.log(response);
POST /sales/_search?size=0&filter_path=aggregations
{
  "aggs": {
    "avg_price": { "avg": { "field": "price" } },
    "t_shirts": {
      "filter": { "term": { "type": "t-shirt" } },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    }
  }
}

The previous example calculates the average price of all sales as well as the average price of all T-shirt sales.

Response:

{
  "aggregations": {
    "avg_price": { "value": 140.71428571428572 },
    "t_shirts": {
      "doc_count": 3,
      "avg_price": { "value": 128.33333333333334 }
    }
  }
}

Use a top-level query to limit all aggregations

edit

To limit the documents on which all aggregations in a search run, use a top-level query. This is faster than a single filter aggregation with sub-aggregations.

For example, use this:

resp = client.search(
    index="sales",
    size="0",
    filter_path="aggregations",
    query={
        "term": {
            "type": "t-shirt"
        }
    },
    aggs={
        "avg_price": {
            "avg": {
                "field": "price"
            }
        }
    },
)
print(resp)
response = client.search(
  index: 'sales',
  size: 0,
  filter_path: 'aggregations',
  body: {
    query: {
      term: {
        type: 't-shirt'
      }
    },
    aggregations: {
      avg_price: {
        avg: {
          field: 'price'
        }
      }
    }
  }
)
puts response
const response = await client.search({
  index: "sales",
  size: 0,
  filter_path: "aggregations",
  query: {
    term: {
      type: "t-shirt",
    },
  },
  aggs: {
    avg_price: {
      avg: {
        field: "price",
      },
    },
  },
});
console.log(response);
POST /sales/_search?size=0&filter_path=aggregations
{
  "query": { "term": { "type": "t-shirt" } },
  "aggs": {
    "avg_price": { "avg": { "field": "price" } }
  }
}

Instead of this:

resp = client.search(
    index="sales",
    size="0",
    filter_path="aggregations",
    aggs={
        "t_shirts": {
            "filter": {
                "term": {
                    "type": "t-shirt"
                }
            },
            "aggs": {
                "avg_price": {
                    "avg": {
                        "field": "price"
                    }
                }
            }
        }
    },
)
print(resp)
response = client.search(
  index: 'sales',
  size: 0,
  filter_path: 'aggregations',
  body: {
    aggregations: {
      t_shirts: {
        filter: {
          term: {
            type: 't-shirt'
          }
        },
        aggregations: {
          avg_price: {
            avg: {
              field: 'price'
            }
          }
        }
      }
    }
  }
)
puts response
const response = await client.search({
  index: "sales",
  size: 0,
  filter_path: "aggregations",
  aggs: {
    t_shirts: {
      filter: {
        term: {
          type: "t-shirt",
        },
      },
      aggs: {
        avg_price: {
          avg: {
            field: "price",
          },
        },
      },
    },
  },
});
console.log(response);
POST /sales/_search?size=0&filter_path=aggregations
{
  "aggs": {
    "t_shirts": {
      "filter": { "term": { "type": "t-shirt" } },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    }
  }
}

Use the filters aggregation for multiple filters

edit

To group documents using multiple filters, use the filters aggregation. This is faster than multiple filter aggregations.

For example, use this:

resp = client.search(
    index="sales",
    size="0",
    filter_path="aggregations",
    aggs={
        "f": {
            "filters": {
                "filters": {
                    "hats": {
                        "term": {
                            "type": "hat"
                        }
                    },
                    "t_shirts": {
                        "term": {
                            "type": "t-shirt"
                        }
                    }
                }
            },
            "aggs": {
                "avg_price": {
                    "avg": {
                        "field": "price"
                    }
                }
            }
        }
    },
)
print(resp)
response = client.search(
  index: 'sales',
  size: 0,
  filter_path: 'aggregations',
  body: {
    aggregations: {
      f: {
        filters: {
          filters: {
            hats: {
              term: {
                type: 'hat'
              }
            },
            t_shirts: {
              term: {
                type: 't-shirt'
              }
            }
          }
        },
        aggregations: {
          avg_price: {
            avg: {
              field: 'price'
            }
          }
        }
      }
    }
  }
)
puts response
const response = await client.search({
  index: "sales",
  size: 0,
  filter_path: "aggregations",
  aggs: {
    f: {
      filters: {
        filters: {
          hats: {
            term: {
              type: "hat",
            },
          },
          t_shirts: {
            term: {
              type: "t-shirt",
            },
          },
        },
      },
      aggs: {
        avg_price: {
          avg: {
            field: "price",
          },
        },
      },
    },
  },
});
console.log(response);
POST /sales/_search?size=0&filter_path=aggregations
{
  "aggs": {
    "f": {
      "filters": {
        "filters": {
          "hats": { "term": { "type": "hat" } },
          "t_shirts": { "term": { "type": "t-shirt" } }
        }
      },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    }
  }
}

Instead of this:

resp = client.search(
    index="sales",
    size="0",
    filter_path="aggregations",
    aggs={
        "hats": {
            "filter": {
                "term": {
                    "type": "hat"
                }
            },
            "aggs": {
                "avg_price": {
                    "avg": {
                        "field": "price"
                    }
                }
            }
        },
        "t_shirts": {
            "filter": {
                "term": {
                    "type": "t-shirt"
                }
            },
            "aggs": {
                "avg_price": {
                    "avg": {
                        "field": "price"
                    }
                }
            }
        }
    },
)
print(resp)
response = client.search(
  index: 'sales',
  size: 0,
  filter_path: 'aggregations',
  body: {
    aggregations: {
      hats: {
        filter: {
          term: {
            type: 'hat'
          }
        },
        aggregations: {
          avg_price: {
            avg: {
              field: 'price'
            }
          }
        }
      },
      t_shirts: {
        filter: {
          term: {
            type: 't-shirt'
          }
        },
        aggregations: {
          avg_price: {
            avg: {
              field: 'price'
            }
          }
        }
      }
    }
  }
)
puts response
const response = await client.search({
  index: "sales",
  size: 0,
  filter_path: "aggregations",
  aggs: {
    hats: {
      filter: {
        term: {
          type: "hat",
        },
      },
      aggs: {
        avg_price: {
          avg: {
            field: "price",
          },
        },
      },
    },
    t_shirts: {
      filter: {
        term: {
          type: "t-shirt",
        },
      },
      aggs: {
        avg_price: {
          avg: {
            field: "price",
          },
        },
      },
    },
  },
});
console.log(response);
POST /sales/_search?size=0&filter_path=aggregations
{
  "aggs": {
    "hats": {
      "filter": { "term": { "type": "hat" } },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    },
    "t_shirts": {
      "filter": { "term": { "type": "t-shirt" } },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    }
  }
}
« Diversified sampler aggregation Filters aggregation »