Elasticsearch add range filter to aggregation

Question

I'm not experimented in elasticsearch and I have to add a range filter for the field "data.elements.id_element" to the next query:

{
    "aggs": {
      "2": {
        "date_histogram": {
          "field": "@timestamp",
          "calendar_interval": "1d",
          "min_doc_count": 1
        },
        "aggs": {
          "elementId": {
            "terms": {
              "field": "data.elements.id_element",
              "order": {
                "_count": "desc"
              },
              "size": 1000
            },
            "aggs": {
              "Device": {
                "filters": {
                },
                "aggs": {
                }
              }
            }
          }
        }
      }
    },
    "size": 0,
    "docvalue_fields": [
      {
        "field": "@timestamp",
        "format": "date_time"
      }
    ],
    "query": {
      "bool": {
        "filter": [
          {
            "range": {
              "@timestamp": {
                "gte": "startDate",
                "lte": "endDate",
                "format": "strict_date_optional_time"
              }
            }
          }
        ]
      }
    }
  }

I've tried to add to the range part like this, but it's ignored :

{
    "aggs": {
      "2": {
        "date_histogram": {
          "field": "@timestamp",
          "calendar_interval": "1d",
          "min_doc_count": 1
        },
        "aggs": {
          "elementId": {
            "terms": {
              "field": "data.elements.id_element",
              "order": {
                "_count": "desc"
              },
              "size": 1000
            },
            "aggs": {
              "Device": {
                "filters": {
                },
                "aggs": {
                }
              }
            }
          }
        }
      }
    },
    "size": 0,
    "docvalue_fields": [
      {
        "field": "@timestamp",
        "format": "date_time"
      }
    ],
    "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "startDate",
              "lte": "endDate",
              "format": "strict_date_optional_time"
            }
          }
        },
        {
          "range": {
            "data.elements.id_element": {
              "gte": 1,
              "lte": 1001
            }
          }
        }
      ]
    }
  }
}

I've tried this too:

{
    "aggs": {
      "2": {
        "date_histogram": {
          "field": "@timestamp",
          "calendar_interval": "1d",
          "min_doc_count": 1
        },
        "aggs": {
          "elementId": {
            "terms": {
              "field": "data.elements.id_element",
              "order": {
                "_count": "desc"
              },
              "size": 1000
            },
            "aggs": {
              "Device": {
                "filters": {
                },
                "aggs": {
                }
              }
            }
          }
        }
      }
    },
    "size": 0,
    "docvalue_fields": [
      {
        "field": "@timestamp",
        "format": "date_time"
      }
    ],
     "query": {
      "bool": {
      "must": [
        {
          "query_string": {
            "query": "data.elements.id_element:[1 TO 1001]",
            "analyze_wildcard": true,
          }
        }
      ],
        "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "startDate",
              "lte": "endDate",
              "format": "strict_date_optional_time"
            }
          }
        }
      ]
      }
    }
  }

Same result, aleatoire elements id and does not respect the range filter/condition. plz any idea.

Thanks.

Chris Damien · Accepted Answer · 2022-08-04 10:49:51Z

1

For others who can face the same problem, I used partition so I've dispatched my query into many queries following this doc:

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_filtering_values_with_partitions

Maybe there is better solution, but this what worked for me in my context.

answered Aug 4, 2022 at 10:49

Chris Damien

112 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Community Over a year ago

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.

Paulo · Accepted Answer · 2022-02-01 15:28:10Z

0

Considering, that you want to apply filter on a particular aggregation, this can be done as below:

{
   "aggs": {
    "elementId": {
      "aggs": {
        "elementId": {
          "terms": {
              "field": "data.elements.id_element",
              "order": {
                "_count": "desc"
              },
              "size": 1000
            }
        }
      },
      "filter": {
        "bool": {
          "filter": [
            {
              "range": {
              "@timestamp": {
              "gte": "startDate",
              "lte": "endDate",
              "format": "strict_date_optional_time"
            }
          }
            }
          ]
        }
      }
    }
  }
 }

edited Feb 1, 2022 at 15:28

Paulo

11k5 gold badges23 silver badges38 bronze badges

answered Feb 1, 2022 at 13:35

Nishikant Tayade

5433 silver badges18 bronze badges

1 Comment

Chris Damien Over a year ago

It gives the same result ... some ids are in the range others not

Collectives™ on Stack Overflow

Elasticsearch add range filter to aggregation

2 Answers 2

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related