Aggregration Filter doesnt seem to work

[kapso (Kapil Israni)]

I have document of type blog posts, here's what an example looks like

Input:

[
  {
    "id": 1,
    "post_title": "Title 1",
    "published_on": "2021-06-07",
    "tag_ids": [1, 2],
    "authors": [
      {
        "id": 12,
        "name": "Jeff Dawn",
        "emp_type": 10, # Contractor
        "country": "US"
      },
      {
        "id": 14,
        "name": "Steve",
        "emp_type": 20 # Employee ,
        "country": "CA"
      }
    ]
  },
  {
    "id": 2,
    "post_title": "Title 2",
    "published_on": "2021-06-07",
    "tag_ids": [3, 4],
    "authors": [
      {
        "id": 22,
        "name": "Ross",
        "emp_type": 20, # Employee
        "country": "US"
      }
    ]
  }
]

I am doing an aggregation on author id, to query the number of posts published by authors in the last 5 years, filtered by a tag id, and type of the author. So the query is...

Query:

{
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "published_on": {
              "gte": "2016-06-07",
              "lte": "2021-06-07"
            }
          }
        },
        {
          "terms": {
            "tag_ids": [
              9506
            ]
          }
        }
      ]
    }
  },
  "aggregations": {
    "test": {
      "filter": {
        "bool": {
          "filter": {
            "term": {
              "authors.emp_type": 10
            }
          }
        }
      },
      "aggregations": {
        "authors": {
          "terms": {
            "field": "authors.id",
            "size": 400,
            "min_doc_count": 1
          }
        }
      }
    }
  },
  "size": 0
}

Problem:

• The problem is that the aggregations are NOT being filtered on "authors.emp_type": 10
• I am seeing authors with emp_type 10 and non-10 values too
• I tried putting the "authors.emp_type": 10 term filter inside query/bool/filter as well, but running into the same issue, after which I tried aggregation filter

[Otteryoudoing (Graham Ford)]

Hello Kapil, you can accomplish this by using 'must' in your bool query.

Documentation here - Boolean query | Elasticsearch Guide [7.13] | Elastic

I have re-written your query for a test index in a cluster of mine. I believe this does what you'd like

GET testindex/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
          "authors.emp_type": 10
          }
        }
        ],
      "filter": [
        {
          "range": {
            "published_on": {
              "gte": "2016-06-07",
              "lte": "2021-06-07"
            }
          }
        },
        {
          "terms": {
            "tag_ids": [
              9506
            ]
          }
        }
      ]
    }
  },
  "aggregations": {
    "authors": {
      "terms": {
        "field": "authors.id.keyword",
        "size": 400,
        "min_doc_count": 1
      }
    }
  },
  "size": 0
}

Hopefully this helps!