# Filter by histogram bucket key

**URL:** <https://discuss.elastic.co/t/filter-by-histogram-bucket-key/101344>\
**Category:** Elasticsearch\
**Created:** [September 21, 2017, 1:39pm UTC](https://discuss.elastic.co/t/filter-by-histogram-bucket-key/101344 "2017-09-21T13:39:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomisu](https://avatars.discourse-cdn.com/v4/letter/t/e79b87/32.png) [@tomisu](https://discuss.elastic.co/u/tomisu)\
**Post date:** [September 21, 2017, 1:39pm UTC](https://discuss.elastic.co/t/filter-by-histogram-bucket-key/101344/1 "2017-09-21T13:39:58Z")

</div>

Hello, everyone!

### Setup

ElasticSearch 5.4

I have 2 types of document: Contact, and Message. Both with a `created_on` field.  
Message's parent is Contact.

### Goal

I'm trying to make a date histogram with 2 values nested in each bucket: total of **active users** , and how many of them are **returning users**.

- An active user would be a user with a message in the interval.
- A returning user would be a user with a message in the interval, and a message before the interval.

### Problem

I'd like to add a filter bucket to each of the histogram buckets, but that filter would need to access the interval's key (the date).

I can't seem to get this right. I've tried using scripts, but I can't access the key.

I've also tried to do the intervals manually, but it doesn't seem to be a very elegant an efficient solution.

### \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Any suggestions?

Thank you in advance!

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [September 23, 2017, 3:50am UTC](https://discuss.elastic.co/t/filter-by-histogram-bucket-key/101344/2 "2017-09-23T03:50:18Z")

</div>

You should be able to solve this problem with [Filter Aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filter-aggregation.html)

---

<div class="post-metadata">

**Author:** ![jminuscula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jminuscula/32/21266_2.png) [@jminuscula](https://discuss.elastic.co/u/jminuscula)\
**Post date:** [September 25, 2017, 10:28am UTC](https://discuss.elastic.co/t/filter-by-histogram-bucket-key/101344/3 "2017-09-25T10:28:42Z")

</div>

Thanks for the suggestion @thiago, but how would you reference the bucket key inside the nested filter aggregation? That's the key piece we're missing.

Cheers!

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [September 25, 2017, 6:29pm UTC](https://discuss.elastic.co/t/filter-by-histogram-bucket-key/101344/4 "2017-09-25T18:29:22Z")

</div>

You don't apply the filter on the key of the buckets, instead you would apply a range filter aggregation (nested inside a date histogram) on the timestamp field itself and the resulting date histogram will include only the relevant dates.

---

<div class="post-metadata">

**Author:** ![tomisu](https://avatars.discourse-cdn.com/v4/letter/t/e79b87/32.png) [@tomisu](https://discuss.elastic.co/u/tomisu)\
**Post date:** [September 26, 2017, 9:43am UTC](https://discuss.elastic.co/t/filter-by-histogram-bucket-key/101344/5 "2017-09-26T09:43:54Z")

</div>

Thanks for your response!

However, I still don't understand how to do this. I can nest a range filter aggregation inside the date histogram, yes, but how can I get the values of each histogram bucket start time?

Maybe an example can help. This is a query for `Contact`. Inside `returning`, I'd like to filter the contacts in each interval that have a message **before** the interval.

How could I fill `lte` to reference the interval start?

```
'aggs': {
    'by_interval': {
        'date_histogram': {
            'time_zone': 'UTC',
            'field': 'created_on',
            'interval': 'day',
            'min_doc_count': 0,
            'extended_bounds': {
                'min': 1505858400,
                'max': 1506410687
            }
        },
        'aggs': {
            'returning': {
                'filter': {
                    'has_child': {
                        'query': {
                            'range': {
                                'created_on': {
                                    'lte': ???
                                }
                            }
                        },
                        'type': 'message'
                    }
                }
            },
        }
    }
}

```

Thank you very much for your time!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2017, 9:44am UTC](https://discuss.elastic.co/t/filter-by-histogram-bucket-key/101344/6 "2017-10-24T09:44:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.