summaryrefslogtreecommitdiff
path: root/docs/reference/aggregations/bucket/filters-aggregation.asciidoc
diff options
context:
space:
mode:
Diffstat (limited to 'docs/reference/aggregations/bucket/filters-aggregation.asciidoc')
-rw-r--r--docs/reference/aggregations/bucket/filters-aggregation.asciidoc128
1 files changed, 128 insertions, 0 deletions
diff --git a/docs/reference/aggregations/bucket/filters-aggregation.asciidoc b/docs/reference/aggregations/bucket/filters-aggregation.asciidoc
new file mode 100644
index 0000000000..2553758d77
--- /dev/null
+++ b/docs/reference/aggregations/bucket/filters-aggregation.asciidoc
@@ -0,0 +1,128 @@
+[[search-aggregations-bucket-filters-aggregation]]
+=== Filters Aggregation
+
+Defines a multi bucket aggregations where each bucket is associated with a
+filter. Each bucket will collect all documents that match its associated
+filter.
+
+Example:
+
+[source,js]
+--------------------------------------------------
+{
+ "aggs" : {
+ "messages" : {
+ "filters" : {
+ "filters" : {
+ "errors" : { "term" : { "body" : "error" }},
+ "warnings" : { "term" : { "body" : "warning" }}
+ }
+ },
+ "aggs" : {
+ "monthly" : {
+ "histogram" : {
+ "field" : "timestamp",
+ "interval" : "1M"
+ }
+ }
+ }
+ }
+ }
+}
+--------------------------------------------------
+
+In the above example, we analyze log messages. The aggregation will build two
+collection (buckets) of log messages - one for all those containing an error,
+and another for all those containing a warning. And for each of these buckets
+it will break them down by month.
+
+Response:
+
+[source,js]
+--------------------------------------------------
+...
+ "aggs" : {
+ "messages" : {
+ "buckets" : {
+ "errors" : {
+ "doc_count" : 34,
+ "monthly" : {
+ "buckets : [
+ ... // the histogram monthly breakdown
+ ]
+ }
+ },
+ "warnings" : {
+ "doc_count" : 439,
+ "monthly" : {
+ "buckets : [
+ ... // the histogram monthly breakdown
+ ]
+ }
+ }
+ }
+ }
+ }
+ }
+...
+--------------------------------------------------
+
+==== Anonymous filters
+
+The filters field can also be provided as an array of filters, as in the
+following request:
+
+[source,js]
+--------------------------------------------------
+{
+ "aggs" : {
+ "messages" : {
+ "filters" : {
+ "filters" : [
+ { "term" : { "body" : "error" }},
+ { "term" : { "body" : "warning" }}
+ ]
+ },
+ "aggs" : {
+ "monthly" : {
+ "histogram" : {
+ "field" : "timestamp",
+ "interval" : "1M"
+ }
+ }
+ }
+ }
+ }
+}
+--------------------------------------------------
+
+The filtered buckets are returned in the same order as provided in the
+request. The response for this example would be:
+
+[source,js]
+--------------------------------------------------
+...
+ "aggs" : {
+ "messages" : {
+ "buckets" : [
+ {
+ "doc_count" : 34,
+ "monthly" : {
+ "buckets : [
+ ... // the histogram monthly breakdown
+ ]
+ }
+ },
+ {
+ "doc_count" : 439,
+ "monthly" : {
+ "buckets : [
+ ... // the histogram monthly breakdown
+ ]
+ }
+ }
+ ]
+ }
+ }
+...
+-------------------------------------------------- \ No newline at end of file