# Filter entries in an aggregation by wildcard string?

**URL:** <https://discuss.elastic.co/t/filter-entries-in-an-aggregation-by-wildcard-string/216406>\
**Category:** Elasticsearch\
**Created:** [January 24, 2020, 11:07am UTC](https://discuss.elastic.co/t/filter-entries-in-an-aggregation-by-wildcard-string/216406 "2020-01-24T11:07:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![very\_sneaky](https://avatars.discourse-cdn.com/v4/letter/v/49beb7/32.png) [@very\_sneaky](https://discuss.elastic.co/u/very_sneaky)\
**Post date:** [January 24, 2020, 11:07am UTC](https://discuss.elastic.co/t/filter-entries-in-an-aggregation-by-wildcard-string/216406/1 "2020-01-24T11:07:31Z")

</div>

hey all, I'm having trouble formulating a query, and I'm hoping someone can help. This is the format of my data:

```auto
{
    "srcIp": "192.168.0.54",
    "dstIp": "74.125.195.147",
    "srcMac": ["ec:f4:bb:4f:b0:96", "0a:f7:bc:44:c0:d7"],
    "dstMac": ["78:54:2e:9f:10:28"],
}

```

My objective is to return a list of unique `srcIp`'s, and count the number of `srcMac`'s for each unique `srcIp` that have the prefix `ec:f4:bb`.

The query I have at the moment is:

```auto
{
    "size": 0,
    "aggs" : {
        "unique_ips": {
            "terms": {
                "field": "srcIp",
            },
            "aggs": {
                "num_macs": {
                    "cardinality": {
                        "field": "srcMac"
                    }
                }
            }
        }
    }
}

```

And this works great; it returns the number of `srcMac` elements for each unique `srcIp`. However, it doesn't match the prefix string. To be explicit, for the provided sample data, i want it to return `srcIp: 192.168.0.54` and `num_macs: 1`, as only the first element of the `srcMac` list matches the prefix `ec:f4:bb`.

I've tried a number of combinations of filter, filters, nested, match, and wildcard directives, but haven't been able to get it to do what I want. For some of them, it looks like they may not work with aggregations, and others it's probably likely that I just don't know what I'm doing.

Can anyone point me in the right direction/give me an example of how I can get what I want out of this? Any answers are appreciated.

Cheers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2020, 11:07am UTC](https://discuss.elastic.co/t/filter-entries-in-an-aggregation-by-wildcard-string/216406/2 "2020-02-21T11:07:35Z")

</div>

Closed on February 21, 2020, 11:07am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.