# Aggregation queries question

**URL:** <https://discuss.elastic.co/t/aggregation-queries-question/126962>\
**Category:** Elasticsearch\
**Created:** [April 5, 2018, 3:31pm UTC](https://discuss.elastic.co/t/aggregation-queries-question/126962 "2018-04-05T15:31:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![nathen.hinson](https://avatars.discourse-cdn.com/v4/letter/n/e9c0ed/32.png) [@nathen.hinson](https://discuss.elastic.co/u/nathen.hinson)\
**Post date:** [April 5, 2018, 3:31pm UTC](https://discuss.elastic.co/t/aggregation-queries-question/126962/1 "2018-04-05T15:31:18Z")

</div>

Hello,

I have roughly 68 million documents across four indices that have identical mappings, for example:  
{  
'log\_time': '2017-01-06T09:23:00Z',  
'extra': {},  
'used': False,  
'who': u'Bruno',  
'interaction\_id': u'Fifty-five',  
'what': u'message',  
'value': u'=== Closed Without Comment ==='  
}

I am looking to return a group of interaction\_ids where each group has _at least one of the following_ filters are true: At least one document where 'what' is 'Status' and the value is 'New',  
At least one document where 'what' is 'Status' and the value is 'Closed' and at least one document where 'what' is 'Queue' and 'value' is 'Breakfix'.

I have tried combinations of a nested filtering aggregation, straight up pipeline bucket aggregation, bucketing by the filter conditions and then attempting to a child aggregation where it buckets by interaction\_id all to no avail.

Would anyone have any suggestions what I might try next?

With Thanks!

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [April 5, 2018, 3:39pm UTC](https://discuss.elastic.co/t/aggregation-queries-question/126962/2 "2018-04-05T15:39:27Z")

</div>

How many unique interaction\_ids are there?

---

<div class="post-metadata">

**Author:** ![nathen.hinson](https://avatars.discourse-cdn.com/v4/letter/n/e9c0ed/32.png) [@nathen.hinson](https://discuss.elastic.co/u/nathen.hinson)\
**Post date:** [April 5, 2018, 3:42pm UTC](https://discuss.elastic.co/t/aggregation-queries-question/126962/3 "2018-04-05T15:42:54Z")

</div>

About 3 million

---

<div class="post-metadata">

**Author:** ![nathen.hinson](https://avatars.discourse-cdn.com/v4/letter/n/e9c0ed/32.png) [@nathen.hinson](https://discuss.elastic.co/u/nathen.hinson)\
**Post date:** [April 5, 2018, 5:08pm UTC](https://discuss.elastic.co/t/aggregation-queries-question/126962/4 "2018-04-05T17:08:20Z")

</div>

Sorry replied to the thread and not to you: Its roughly 3 million unique interaction\_ids

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [April 6, 2018, 7:29am UTC](https://discuss.elastic.co/t/aggregation-queries-question/126962/5 "2018-04-06T07:29:25Z")

</div>

Joins on high cardinality fields are problematic for any distributed system. Here’s why and shows a way to work round it: [https://youtu.be/yBf7oeJKH2Y](https://youtu.be/yBf7oeJKH2Y)

---

<div class="post-metadata">

**Author:** ![nathen.hinson](https://avatars.discourse-cdn.com/v4/letter/n/e9c0ed/32.png) [@nathen.hinson](https://discuss.elastic.co/u/nathen.hinson)\
**Post date:** [April 9, 2018, 1:39pm UTC](https://discuss.elastic.co/t/aggregation-queries-question/126962/6 "2018-04-09T13:39:55Z")

</div>

That's a great resource. Thanks Mark!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2018, 1:40pm UTC](https://discuss.elastic.co/t/aggregation-queries-question/126962/7 "2018-05-07T13:40:23Z")

</div>

Closed on May 7, 2018, 1:40pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.