# Apply Composite Aggregation on Filtered Data

**URL:** <https://discuss.elastic.co/t/apply-composite-aggregation-on-filtered-data/225790>\
**Category:** Elasticsearch\
**Created:** [March 31, 2020, 5:34am UTC](https://discuss.elastic.co/t/apply-composite-aggregation-on-filtered-data/225790 "2020-03-31T05:34:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Srinivas\_AR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srinivas_ar/32/65353_2.png) [@Srinivas\_AR](https://discuss.elastic.co/u/Srinivas_AR)\
**Post date:** [March 31, 2020, 5:34am UTC](https://discuss.elastic.co/t/apply-composite-aggregation-on-filtered-data/225790/1 "2020-03-31T05:34:43Z")

</div>

I'm using "Composite Aggregation" as my use case requires "Pagination" on buckets returned by Aggregation, as the number of returned buckets could be huge.

I also need to run "Composite aggregation" on a specific time range, I'm using a "range" filter for this. However, the response from elasticsearch does not contain any data in "aggregations". "hits" array does contain proper data as per filter. I'm only interested in the result of "Composite Aggregation".

Am I missing something?

_ **Request is as below :** _

```auto
GET <my-index>/_search 
{
  "query" : {
    "range" : {
      "@timestamp" : {
        "gte" : "2020-03-29T14:53:42.068Z",
        "lt" : "2020-03-29T15:53:42.068Z"
      }
    }
  },
  "aggs" : {
    "uniq_userids": {
      "composite" : {
        "size": 100,
        "sources" : [
          { "by_userid": { "terms" : { "field": "userid.keyword" } } }
        ]
      }
    } 
  } 
}

```

Response is as below :\*\*

```auto
{
  "took" : 10,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 12,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
          ...
    ]
  },
  "aggregations" : {
    "uniq_userids" : {
      "buckets" : []
    }
  }
}

```

**Expected output in aggregations element**

```auto
"aggregations" : {
    "uniq_userids" : {
      "after_key" : {
        "by_userid" : "user4"
      },
      "buckets" : [
        {
          "key" : {
            "by_userid" : "user1"
          },
          "doc_count" : 3
        },
        {
          "key" : {
            "by_userid" : "user2"
          },
          "doc_count" : 3
        },
        {
          "key" : {
            "by_userid" : "user3"
          },
          "doc_count" : 2
        }
      ]
    }
  }

```

---

<div class="post-metadata">

**Author:** ![Srinivas\_AR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srinivas_ar/32/65353_2.png) [@Srinivas\_AR](https://discuss.elastic.co/u/Srinivas_AR)\
**Post date:** [April 1, 2020, 6:01am UTC](https://discuss.elastic.co/t/apply-composite-aggregation-on-filtered-data/225790/2 "2020-04-01T06:01:10Z")

</div>

I was able to debug the issue. Issue was in logstash patterns. I was storing userid value in a different field.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2020, 6:16am UTC](https://discuss.elastic.co/t/apply-composite-aggregation-on-filtered-data/225790/3 "2020-04-29T06:16:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.