Buckets size filter

Elastic Stack Elasticsearch
1

Hi everybody

I want my query to return only bucket[].size > 0
How can I do this?

Thanks

Here is my query result

{
  "took": 3,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 502,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "HIGH_RISK_USERS": {
      "doc_count": 1004,
      "USERS_COUNT": {
        "doc_count_error_upper_bound": 5,
        "sum_other_doc_count": 437,
        "buckets": [
          {
            "key": "49",
            "doc_count": 502,
            "NAME": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": []
            }
          },
          {
            "key": "02122219455@53.205.223.157",
            "doc_count": 44,
            "NAME": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                {
                  "key": "caller",
                  "doc_count": 42
                },
                {
                  "key": "CallFrom",
                  "doc_count": 2
                }
              ]
            }
          },
          {
            "key": "+02129916178@53.205.223.157",
            "doc_count": 2,
            "NAME": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                {
                  "key": "caller",
                  "doc_count": 2
                }
              ]
            }
          }
        ]
      }
    }
  }
}

Here is my query

    {
      "size": 0,
      "query": {
        "bool": {
          "filter": [
            {
              "nested": {
                "path": "x_nova_extensions.entities",
                "query": {
                  "bool": {
                    "filter": [
                      {
                        "match": {
                          "x_nova_extensions.entities.text": "49"
                        }
                      },
                      {
                        "terms": {
                          "x_nova_extensions.entities.type": [
                            "sourceCountryCode",
                            "CallerIPCountryCode",
                            "CallerIPCountryName",
                            "CallerIPCountryCode",
                            "CallerPhoneCountryName"
                          ]
                        }
                      }
                    ]
                  }
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "HIGH_RISK_USERS": {
          "nested": {
            "path": "x_nova_extensions.entities"
          },
          "aggs": {
            "USERS_COUNT": {
              "terms": {
                "field": "x_nova_extensions.entities.text",
                "size": 10,
                "order": {
                  "_count": "desc"
                }
              },
              "aggs": {
                "NAME": {
                  "terms": {
                    "field": "x_nova_extensions.entities.type",
                    "include": [
                      "caller",
                      "callee",
                      "CallFrom",
                      "CallTo"
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.