I want to that some terns are excluded from the search, this is de cod:
GET /imsva_message/_search
{
"size": 0,
"aggs" : {
"aggdata" : {
"filter": {
"range": {
"data1": {
"from": "now-15m",
"to": "now"
}
}
},
"aggs" : {
"aggremetente" : {
"terms" : {
"field" : "remetente.keyword",
"min_doc_count":50
}
}
}
}
}
}
and this is the result:
{
"took" : 227,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 3188121,
"max_score" : 0.0,
"hits" : [ ]
},
"aggregations" : {
"aggdata" : {
"doc_count" : 1254,
"aggremetente" : {
"doc_count_error_upper_bound" : 5,
"sum_other_doc_count" : 309,
"buckets" : [
{
"key" : "xxx@xxx.xxx.xxx",
"doc_count" : 464
},
{
"key" : "yyy.yyy@yyy.yyy.yyy",
"doc_count" : 159
},
{
"key" : "zzz@zzz.zzz.zzz",
"doc_count" : 50
}
]
}
}
}
}
how do I do for the result to be:
{
"took" : 227,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 3188121,
"max_score" : 0.0,
"hits" : [ ]
},
"aggregations" : {
"aggdata" : {
"doc_count" : 1254,
"aggremetente" : {
"doc_count_error_upper_bound" : 5,
"sum_other_doc_count" : 309,
"buckets" : [
{
"key" : "yyy.yyy@yyy.yyy.yyy",
"doc_count" : 159
},
{
"key" : "zzz@zzz.zzz.zzz",
"doc_count" : 50
}
]
}
}
}
}
removing the term :
{
"key" : "xxx@xxx.xxx.xxx",
"doc_count" : 464
}
of search, or removing any other terms for the search?