|
|
@@ -1,113 +1,130 @@
|
|
|
[[search-aggregations-bucket-filters-aggregation]]
|
|
|
=== Filters
|
|
|
|
|
|
-Defines a multi bucket aggregations where each bucket is associated with a filter. Each bucket will collect all
|
|
|
-documents that match its associated filter.
|
|
|
+coming[1.4.0]
|
|
|
+
|
|
|
+Defines a multi bucket aggregations where each bucket is associated with a
|
|
|
+filter. Each bucket will collect all documents that match its associated
|
|
|
+filter.
|
|
|
|
|
|
Example:
|
|
|
|
|
|
[source,js]
|
|
|
--------------------------------------------------
|
|
|
{
|
|
|
- "aggs" : {
|
|
|
- "messages" : {
|
|
|
- "filters" : {
|
|
|
- "filters" : {
|
|
|
- "errors" : { "query" : { "match" : { "body" : "error" } } },
|
|
|
- "warnings" : { "query" : { "match" : { "body" : "warning" } } }
|
|
|
- }
|
|
|
- },
|
|
|
- "aggs" : { "monthly" : { "histogram" : { "field" : "timestamp", "interval" : "1M" } } }
|
|
|
+ "aggs" : {
|
|
|
+ "messages" : {
|
|
|
+ "filters" : {
|
|
|
+ "filters" : {
|
|
|
+ "errors" : { "term" : { "body" : "error" }},
|
|
|
+ "warnings" : { "term" : { "body" : "warning" }}
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "aggs" : {
|
|
|
+ "monthly" : {
|
|
|
+ "histogram" : {
|
|
|
+ "field" : "timestamp",
|
|
|
+ "interval" : "1M"
|
|
|
+ }
|
|
|
}
|
|
|
+ }
|
|
|
}
|
|
|
+ }
|
|
|
}
|
|
|
--------------------------------------------------
|
|
|
|
|
|
-In the above example, we analyze log messages. The aggregation will build two collection (buckets) of log messages - one
|
|
|
-for all those containing an error, and another for all those containing a warning. And for each of these buckets it will
|
|
|
-break them down by month.
|
|
|
+In the above example, we analyze log messages. The aggregation will build two
|
|
|
+collection (buckets) of log messages - one for all those containing an error,
|
|
|
+and another for all those containing a warning. And for each of these buckets
|
|
|
+it will break them down by month.
|
|
|
|
|
|
Response:
|
|
|
|
|
|
[source,js]
|
|
|
--------------------------------------------------
|
|
|
-{
|
|
|
- ...
|
|
|
-
|
|
|
- "aggs" : {
|
|
|
- "messages" : {
|
|
|
- "buckets" : {
|
|
|
- "errors" : {
|
|
|
- "doc_count" : 34,
|
|
|
- "monthly" : {
|
|
|
- "buckets : [
|
|
|
- ... // the histogram monthly breakdown
|
|
|
- ]
|
|
|
- }
|
|
|
- },
|
|
|
- "warnings" : {
|
|
|
- "doc_count" : 439,
|
|
|
- "monthly" : {
|
|
|
- "buckets : [
|
|
|
- ... // the histogram monthly breakdown
|
|
|
- ]
|
|
|
- }
|
|
|
- }
|
|
|
+...
|
|
|
+ "aggs" : {
|
|
|
+ "messages" : {
|
|
|
+ "buckets" : {
|
|
|
+ "errors" : {
|
|
|
+ "doc_count" : 34,
|
|
|
+ "monthly" : {
|
|
|
+ "buckets : [
|
|
|
+ ... // the histogram monthly breakdown
|
|
|
+ ]
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "warnings" : {
|
|
|
+ "doc_count" : 439,
|
|
|
+ "monthly" : {
|
|
|
+ "buckets : [
|
|
|
+ ... // the histogram monthly breakdown
|
|
|
+ ]
|
|
|
}
|
|
|
+ }
|
|
|
}
|
|
|
+ }
|
|
|
}
|
|
|
-}
|
|
|
+ }
|
|
|
+...
|
|
|
--------------------------------------------------
|
|
|
|
|
|
==== Anonymous filters
|
|
|
|
|
|
-The filters field can also be provided as an array of filters, as in the following request:
|
|
|
+The filters field can also be provided as an array of filters, as in the
|
|
|
+following request:
|
|
|
|
|
|
[source,js]
|
|
|
--------------------------------------------------
|
|
|
{
|
|
|
- "aggs" : {
|
|
|
- "messages" : {
|
|
|
- "filters" : {
|
|
|
- "filters" : [
|
|
|
- "query" : { "match" : { "body" : "error" } },
|
|
|
- "query" : { "match" : { "body" : "warning" } }
|
|
|
- ]
|
|
|
- },
|
|
|
- "aggs" : { "monthly" : { "histogram" : { "field" : "timestamp", "interval" : "1M" } } }
|
|
|
+ "aggs" : {
|
|
|
+ "messages" : {
|
|
|
+ "filters" : {
|
|
|
+ "filters" : [
|
|
|
+ { "term" : { "body" : "error" }},
|
|
|
+ { "term" : { "body" : "warning" }}
|
|
|
+ ]
|
|
|
+ },
|
|
|
+ "aggs" : {
|
|
|
+ "monthly" : {
|
|
|
+ "histogram" : {
|
|
|
+ "field" : "timestamp",
|
|
|
+ "interval" : "1M"
|
|
|
+ }
|
|
|
}
|
|
|
+ }
|
|
|
}
|
|
|
+ }
|
|
|
}
|
|
|
--------------------------------------------------
|
|
|
|
|
|
-The filtered buckets are returned in the same order as provided in the request. The response for this example would be:
|
|
|
+The filtered buckets are returned in the same order as provided in the
|
|
|
+request. The response for this example would be:
|
|
|
|
|
|
[source,js]
|
|
|
--------------------------------------------------
|
|
|
-{
|
|
|
- ...
|
|
|
-
|
|
|
- "aggs" : {
|
|
|
- "messages" : {
|
|
|
- "buckets" : [
|
|
|
- {
|
|
|
- "doc_count" : 34,
|
|
|
- "monthly" : {
|
|
|
- "buckets : [
|
|
|
- ... // the histogram monthly breakdown
|
|
|
- ]
|
|
|
- }
|
|
|
- },
|
|
|
- {
|
|
|
- "doc_count" : 439,
|
|
|
- "monthly" : {
|
|
|
- "buckets : [
|
|
|
- ... // the histogram monthly breakdown
|
|
|
- ]
|
|
|
- }
|
|
|
- }
|
|
|
+...
|
|
|
+ "aggs" : {
|
|
|
+ "messages" : {
|
|
|
+ "buckets" : [
|
|
|
+ {
|
|
|
+ "doc_count" : 34,
|
|
|
+ "monthly" : {
|
|
|
+ "buckets : [
|
|
|
+ ... // the histogram monthly breakdown
|
|
|
]
|
|
|
+ }
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "doc_count" : 439,
|
|
|
+ "monthly" : {
|
|
|
+ "buckets : [
|
|
|
+ ... // the histogram monthly breakdown
|
|
|
+ ]
|
|
|
+ }
|
|
|
}
|
|
|
+ ]
|
|
|
}
|
|
|
-}
|
|
|
+ }
|
|
|
+...
|
|
|
--------------------------------------------------
|