# Bucket selector in sub aggregation or cardinality aggregation
**URL:** https://discuss.elastic.co/t/bucket-selector-in-sub-aggregation-or-cardinality-aggregation/193060
**Category:** Elasticsearch
**Created:** [July 31, 2019, 7:50am UTC](https://discuss.elastic.co/t/bucket-selector-in-sub-aggregation-or-cardinality-aggregation/193060 "2019-07-31T07:50:12Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Vladpov](https://discuss.elastic.co/u/Vladpov)
#### Post date: [July 31, 2019, 7:50am UTC](https://discuss.elastic.co/t/bucket-selector-in-sub-aggregation-or-cardinality-aggregation/193060/1 "2019-07-31T07:50:12Z")
Hi guys
I have this query
```
GET /my_index3/_search
{
"size": 0,
"aggs": {
"num1": {
"terms": {
"field": "num1.keyword",
"order" : { "_count" : "desc" }
},
"aggs": {
"count_of_distinct_suffix": {
"cardinality" :{
"field" : "suffix.keyword"
}
}
}
}
}
}
```
That has this output
```
"key" : "1563866656878888",
"doc_count" : 42,
"count_of_distinct_suffix" : {
"value" : 2
}
},
{
"key" : "1563866656871111",
"doc_count" : 40,
"count_of_distinct_suffix" : {
"value" : 2
}
},
{
"key" : "1563867854325555",
"doc_count" : 36,
"count_of_distinct_suffix" : {
"value" : 1
}
},
{
"key" : "1563867854323333",
"doc_count" : 12,
"count_of_distinct_suffix" : {
"value" : 1
}
},
```
I want to see only the results which have `"count_of_distinct_suffix" : { "value" : 2 }`
I'm thinking about bucket selector aggregation but it's impossible to add it into the cardinality aggs...
```
"aggs": {
"my_filter": {
"bucket_selector": {
"buckets_path": {
"the_doc_count": "_count"
},
"script": "params.doc_count == 2"
}
}
}
```
It gives me the following error: `Aggregator [count_of_distinct_suffix] of type [cardinality] cannot accept sub-aggregations`
Do you guys have any idea to solve it?
Thank you very much for any help in advance !!
---
### Author:  [@abdon](https://discuss.elastic.co/u/abdon)
#### Post date: [July 31, 2019, 9:23am UTC](https://discuss.elastic.co/t/bucket-selector-in-sub-aggregation-or-cardinality-aggregation/193060/2 "2019-07-31T09:23:15Z")
It looks like you nested the bucket\_selector aggregation inside the cardinality aggregation. You should nest it inside the terms aggregation instead. The following works:
```auto
GET /my_index3/_search
{
"size": 0,
"aggs": {
"num1": {
"terms": {
"field": "num1.keyword",
"order": {
"_count": "desc"
}
},
"aggs": {
"count_of_distinct_suffix": {
"cardinality": {
"field": "suffix.keyword"
}
},
"my_filter": {
"bucket_selector": {
"buckets_path": {
"count_of_distinct_suffix": "count_of_distinct_suffix"
},
"script": "params.count_of_distinct_suffix == 2"
}
}
}
}
}
}
```
(By the way, screenshots of requests and responses are not a good format for sharing code snippets on this forum. Please share those as plain text, formatted with the `` button. It makes it much easier for folks to help you 🙂 )
---
### Author:  [@Vladpov](https://discuss.elastic.co/u/Vladpov)
#### Post date: [July 31, 2019, 9:40am UTC](https://discuss.elastic.co/t/bucket-selector-in-sub-aggregation-or-cardinality-aggregation/193060/3 "2019-07-31T09:40:05Z")
Thank you very much for your help!
May I ask you another question please? 😃
How would you show the same result but only if the cardinality of two suffix happens within 72 hours?
```
"range": {
"within72hours": {
"gte": "now-72h"
}
}
```
---
### Author:  [@pmusa](https://discuss.elastic.co/u/pmusa)
#### Post date: [July 31, 2019, 9:44am UTC](https://discuss.elastic.co/t/bucket-selector-in-sub-aggregation-or-cardinality-aggregation/193060/4 "2019-07-31T09:44:45Z")
Yes, a range query would do the trick.
[https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html)
---
### Author:  [@Vladpov](https://discuss.elastic.co/u/Vladpov)
#### Post date: [July 31, 2019, 10:17am UTC](https://discuss.elastic.co/t/bucket-selector-in-sub-aggregation-or-cardinality-aggregation/193060/5 "2019-07-31T10:17:37Z")
Thank you for your reply!
I mean that num1 has only 1 suffix and if the same num1 didn't get second suffix within some time e.g one hour it wouldn't show this bucket even if the count\_of\_distinct\_suffix == 2.
I think the range query just show me the frame of the buckets in defined range or am I mistaken?
---
### Author:  [@abdon](https://discuss.elastic.co/u/abdon)
#### Post date: [July 31, 2019, 12:00pm UTC](https://discuss.elastic.co/t/bucket-selector-in-sub-aggregation-or-cardinality-aggregation/193060/6 "2019-07-31T12:00:58Z")
The query will limit the scope of the aggregations. That means, you will only see buckets for documents in the last 72 hours. So, only if the count\_of\_distinct\_suffix == 2 for the last 72 hours will a bucket be returned.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 28, 2019, 12:01pm UTC](https://discuss.elastic.co/t/bucket-selector-in-sub-aggregation-or-cardinality-aggregation/193060/7 "2019-08-28T12:01:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.