# Buckets size filter

**URL:** <https://discuss.elastic.co/t/buckets-size-filter/123520>\
**Category:** Elasticsearch\
**Created:** [March 12, 2018, 9:58am UTC](https://discuss.elastic.co/t/buckets-size-filter/123520 "2018-03-12T09:58:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cekeriya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cekeriya/32/27594_2.png) [@cekeriya](https://discuss.elastic.co/u/cekeriya)\
**Post date:** [March 12, 2018, 9:58am UTC](https://discuss.elastic.co/t/buckets-size-filter/123520/1 "2018-03-12T09:58:42Z")

</div>

Hi everybody

I want my query to return only **bucket[].size \> 0**  
How can I do this?

Thanks

Here is my query result

```
{
  "took": 3,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 502,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "HIGH_RISK_USERS": {
      "doc_count": 1004,
      "USERS_COUNT": {
        "doc_count_error_upper_bound": 5,
        "sum_other_doc_count": 437,
        "buckets": [
          {
            "key": "49",
            "doc_count": 502,
            "NAME": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": []
            }
          },
          {
            "key": "02122219455@53.205.223.157",
            "doc_count": 44,
            "NAME": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                {
                  "key": "caller",
                  "doc_count": 42
                },
                {
                  "key": "CallFrom",
                  "doc_count": 2
                }
              ]
            }
          },
          {
            "key": "+02129916178@53.205.223.157",
            "doc_count": 2,
            "NAME": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                {
                  "key": "caller",
                  "doc_count": 2
                }
              ]
            }
          }
        ]
      }
    }
  }
}

```

Here is my query

```
    {
      "size": 0,
      "query": {
        "bool": {
          "filter": [
            {
              "nested": {
                "path": "x_nova_extensions.entities",
                "query": {
                  "bool": {
                    "filter": [
                      {
                        "match": {
                          "x_nova_extensions.entities.text": "49"
                        }
                      },
                      {
                        "terms": {
                          "x_nova_extensions.entities.type": [
                            "sourceCountryCode",
                            "CallerIPCountryCode",
                            "CallerIPCountryName",
                            "CallerIPCountryCode",
                            "CallerPhoneCountryName"
                          ]
                        }
                      }
                    ]
                  }
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "HIGH_RISK_USERS": {
          "nested": {
            "path": "x_nova_extensions.entities"
          },
          "aggs": {
            "USERS_COUNT": {
              "terms": {
                "field": "x_nova_extensions.entities.text",
                "size": 10,
                "order": {
                  "_count": "desc"
                }
              },
              "aggs": {
                "NAME": {
                  "terms": {
                    "field": "x_nova_extensions.entities.type",
                    "include": [
                      "caller",
                      "callee",
                      "CallFrom",
                      "CallTo"
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2018, 9:58am UTC](https://discuss.elastic.co/t/buckets-size-filter/123520/2 "2018-04-09T09:58:56Z")

</div>

Closed on April 9, 2018, 9:58am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.