Filter Aggregation

Defines a single-bucket of all the documents in the current document set context that match a specified filter.

Structuring

The following snippet captures the structure of filter aggregations:

"<aggregation_name>": {
  "_filter": {
    "_term": {
      ( "<key>": <value>, )*
    }
  },
  ...
}

Also supports all other functionality as explained in Bucket Aggregations.

Filtering Terms

Often this will be used to narrow down the current aggregation context to a specific set of documents containing certain terms.

Assuming the data consists of documents representing bank accounts, as shown in the sample dataset of Data Exploration section:

SEARCH /bank/

{
  "_query": "*",
  "_limit": 0,
  "_check_at_least": 1000,
  "_aggs": {
    "strawberry_lovers": {
      "_filter": {
        "_term": {
          "favoriteFruit": "strawberry"
        }
      },
      "_aggs": {
        "avg_balance": {
          "_avg": {
            "_field": "balance"
          }
        }
      }
    }
  }
}

In the above example, we calculate the average balance of all the bank accounts with holders who fancy strawberries.

Response:

{
  "aggregations": {
    "_doc_count": 1000,
    "strawberry_lovers": {
      "_doc_count": 76,
      "avg_balance": {
        "_avg": 2581.807236842105
      }
    }
  }, ...
}