# Filter/ order buckets of ip\_range agg

**URL:** <https://discuss.elastic.co/t/filter-order-buckets-of-ip-range-agg/67609>\
**Category:** Elasticsearch\
**Created:** [November 30, 2016, 12:10pm UTC](https://discuss.elastic.co/t/filter-order-buckets-of-ip-range-agg/67609 "2016-11-30T12:10:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gad](https://avatars.discourse-cdn.com/v4/letter/g/b5a626/32.png) [@gad](https://discuss.elastic.co/u/gad)\
**Post date:** [November 30, 2016, 12:10pm UTC](https://discuss.elastic.co/t/filter-order-buckets-of-ip-range-agg/67609/1 "2016-11-30T12:10:05Z")

</div>

Hi,

I'm trying to sort and filter result buckets of an ip\_range agg and can't find how to do it. my query:

```
GET /firewall_hits/_search
{
  "size": 0,
  "aggs": {
    "agg1": {
      "ip_range": {
        "field": "src",
        "ranges": [
          {
            "mask": "10.100.0.0/16"
          },
          {
            "mask": "192.168.0.0/16"
          },
          {
            "mask": "1.168.0.0/16"
          }
        ]
      }
  }
}
}

```

result :

```
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 73458077,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "agg1": {
      "buckets": [
        {
          "key": "1.168.0.0/16",
          "from": "1.168.0.0",
          "to": "1.168.255.255",
          "doc_count": 0
        },
        {
          "key": "10.100.0.0/16",
          "from": "10.100.0.0",
          "to": "10.100.255.255",
          "doc_count": 12855055
        },
        {
          "key": "192.168.0.0/16",
          "from": "192.168.0.0",
          "to": "192.168.255.255",
          "doc_count": 49888908
        }
      ]
    }
  }
}

```

1. How do I order buckets by doc\_count?
2. how do i filter buckets where doc\_count \> 0 ?

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2016, 12:10pm UTC](https://discuss.elastic.co/t/filter-order-buckets-of-ip-range-agg/67609/2 "2016-12-28T12:10:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.