# Filter after selecting top 5 hits

**URL:** <https://discuss.elastic.co/t/filter-after-selecting-top-5-hits/245290>\
**Category:** Kibana\
**Created:** [August 17, 2020, 5:22pm UTC](https://discuss.elastic.co/t/filter-after-selecting-top-5-hits/245290 "2020-08-17T17:22:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhavya\_Bansal](https://avatars.discourse-cdn.com/v4/letter/b/958977/32.png) [@Bhavya\_Bansal](https://discuss.elastic.co/u/Bhavya_Bansal)\
**Post date:** [August 17, 2020, 5:22pm UTC](https://discuss.elastic.co/t/filter-after-selecting-top-5-hits/245290/1 "2020-08-17T17:22:12Z")

</div>

Hi,

I'm using the alerting feature in Kibana and I want to check if the last 5 consecutive values of a field exceed a threshold x but if I use a filter in my elastic query, it gets applied before the top N aggregation.

Is there a way in which I can apply the filter after or check if the last consecutive values exceed a threshold using some other selector or method? I don't want to check this in the trigger condition in painless because that will return all the documents in the ctx and not just the ones which exceeded the threshold which I want to display in my alert message.

I've been stuck with this for a while and I have only seen blog posts saying sub aggregation is not possible on top N so any help or work around would be much appreciated.

This is my query :

```
{ 
    "size": 500, 
    "query": { 
        "bool": { 
            "filter": [ 
                { 
                    "match_all": {
                        "boost": 1 
                    } 
                }, 
                {
                    "match_phrase": { 
                        "client.id": { 
                            "query": "42", 
                            "slop": 0, 
                            "zero_terms_query": "NONE", 
                            "boost": 1 
                        } 
                    } 
                }, 
                { 
                    "range": { 
                        "@timestamp": { 
                            "from": "{{period_end}}||-10m", 
                            "to": "{{period_end}}", 
                            "include_lower": true, 
                            "include_upper": true, 
                            "format": "epoch_millis", 
                            "boost": 1 
                        } 
                    }
                } 
            ], 
            "adjust_pure_negative": true, 
            "boost": 1 
        } 

    }, 
    "aggs": {
        "2": {
          "terms": {
            "field": "component.name",
            "order": {
              "_key": "desc"
            },
            "size": 50
          },
          "aggs": {
            "3": {
              "terms": {
                "field": "client.name.keyword",
                "order": {
                  "_key": "desc"
                },
                "size": 5
              },
              "aggs": {
                "1": {
                  "top_hits": {
                    "docvalue_fields": [
                      {
                        "field": "component.stats.gc.oldgen.used.pct",
                        "format": "use_field_mapping"
                      }
                    ],
                    "_source": "component.stats.gc.oldgen.used.pct",
                    "size": 5,
                    "sort": [
                      {
                        "@timestamp": {
                          "order": "desc"
                        }
                      }
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }       
}

```

Thanks

---

<div class="post-metadata">

**Author:** ![monfera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monfera/32/26467_2.png) [@monfera](https://discuss.elastic.co/u/monfera)\
**Post date:** [August 20, 2020, 7:40am UTC](https://discuss.elastic.co/t/filter-after-selecting-top-5-hits/245290/2 "2020-08-20T07:40:06Z")

</div>

Hello Bhavya, let me check this with the team

---

<div class="post-metadata">

**Author:** ![alisongoryachev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisongoryachev/32/111352_2.png) [@alisongoryachev](https://discuss.elastic.co/u/alisongoryachev)\
**Post date:** [August 20, 2020, 5:03pm UTC](https://discuss.elastic.co/t/filter-after-selecting-top-5-hits/245290/3 "2020-08-20T17:03:39Z")

</div>

Hi @Bhavya_Bansal! Can you provide more details - are you trying to create a watch using the [Watcher UI](https://www.elastic.co/guide/en/kibana/current/watcher-ui.html) in Kibana? Thanks!

---

<div class="post-metadata">

**Author:** ![Bhavya\_Bansal](https://avatars.discourse-cdn.com/v4/letter/b/958977/32.png) [@Bhavya\_Bansal](https://discuss.elastic.co/u/Bhavya_Bansal)\
**Post date:** [August 20, 2020, 7:22pm UTC](https://discuss.elastic.co/t/filter-after-selecting-top-5-hits/245290/4 "2020-08-20T19:22:11Z")

</div>

Hi Alison,

I'm using the alerting feature of opendistro.

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![alisongoryachev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisongoryachev/32/111352_2.png) [@alisongoryachev](https://discuss.elastic.co/u/alisongoryachev)\
**Post date:** [August 20, 2020, 7:40pm UTC](https://discuss.elastic.co/t/filter-after-selecting-top-5-hits/245290/5 "2020-08-20T19:40:30Z")

</div>

@Bhavya_Bansal Ah, I see. OpenDistro is using a fork of Elastic products and therefore we do not have details on the issues specific to it. I would recommend [opening an issue at the OpenDistro forum](https://discuss.opendistrocommunity.dev/latest).

---

<div class="post-metadata">

**Author:** ![Bhavya\_Bansal](https://avatars.discourse-cdn.com/v4/letter/b/958977/32.png) [@Bhavya\_Bansal](https://discuss.elastic.co/u/Bhavya_Bansal)\
**Post date:** [August 20, 2020, 7:52pm UTC](https://discuss.elastic.co/t/filter-after-selecting-top-5-hits/245290/6 "2020-08-20T19:52:49Z")

</div>

However, the query works similar to Watcher and my requirement is the same. It would be really helpful if you could suggest something.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2020, 7:52pm UTC](https://discuss.elastic.co/t/filter-after-selecting-top-5-hits/245290/7 "2020-09-17T19:52:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.