# Filter out buckets in an aggregated query

**URL:** https://discuss.elastic.co/t/filter-out-buckets-in-an-aggregated-query/25327
**Category:** Elasticsearch
**Created:** [July 10, 2015, 3:40pm UTC](https://discuss.elastic.co/t/filter-out-buckets-in-an-aggregated-query/25327 "2015-07-10T15:40:31Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![claudio](https://avatars.discourse-cdn.com/v4/letter/c/7cd45c/32.png) [@claudio](https://discuss.elastic.co/u/claudio)
#### Post date: [July 10, 2015, 3:40pm UTC](https://discuss.elastic.co/t/filter-out-buckets-in-an-aggregated-query/25327/1 "2015-07-10T15:40:31Z")

</div>

Hi, I have an aggregation query to get the top\_hits documents filtered by terms of a multi value filed, and I want to filter out the buckets that don't match the filtered values.

Let me explain the situation with an example:

Having this documents:

```auto
id create_time tags 
1 7/1/15 a
2 7/2/15 b,d
3 7/3/15 a,c
4 7/3/15 b
5 7/3/15 e
```

I want to get the latest documents of some tags, for example for "a" and "b" the result should be:

```auto
a -> 3 7/3/15 a,c
b -> 4 7/3/15 b
```

To to this I have the following query:

```auto
{
  "size":0,
  "query":{
    "filtered":{
      "query":{ "match_all":{} },
      "filter":{ "terms":{ "tags":["a", "b"] }
      }
    }
  },
  "aggs":{
    "newest-event-query":{
      "terms":{ "field":"tags", "size":0 },
      "aggs":{
        "newest-event":{
          "top_hits":{ "size":1, "sort":[{ "create_time":{ "order":"desc" } }] }
        }
      }
    }
  }
}
```

The problem is that this query returns buckets for the tags "c" and "d", because there are documents with tag "a" or "b" which have "c" or "d" as well. This is the result:

```auto
a -> 3 7/3/15 a,c
b -> 4 7/3/15 b
c -> 3 7/3/15 a,c
d -> 2 7/2/15 b,d
```

Is there any way to filter out the buckets "c" and "d", and just get buckets for the tags in the filter?

Thanks, Claudio

---

<div class="post-metadata">

### Author: ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)
#### Post date: [July 10, 2015, 4:44pm UTC](https://discuss.elastic.co/t/filter-out-buckets-in-an-aggregated-query/25327/2 "2015-07-10T16:44:36Z")

</div>

you could use the `include` parameter on the terms aggregation to only allow terms which are in your filter. See [https://www.elastic.co/guide/en/elasticsearch/reference/1.6/search-aggregations-bucket-terms-aggregation.html#\_filtering\_values](https://www.elastic.co/guide/en/elasticsearch/reference/1.6/search-aggregations-bucket-terms-aggregation.html#_filtering_values) for more details.

HTH

---

<div class="post-metadata">

### Author: ![claudio](https://avatars.discourse-cdn.com/v4/letter/c/7cd45c/32.png) [@claudio](https://discuss.elastic.co/u/claudio)
#### Post date: [July 10, 2015, 5:01pm UTC](https://discuss.elastic.co/t/filter-out-buckets-in-an-aggregated-query/25327/3 "2015-07-10T17:01:57Z")

</div>

Thanks!, the include parameter works perfect.

Just keep it as reference the complete example is:

```auto
{
  "size":0,
  "query":{
    "filtered":{
      "query":{ "match_all":{} },
      "filter":{ "terms":{ "tags":["a", "b"] }
      }
    }
  },
  "aggs":{
    "newest-event-query":{
      "terms":{ "field":"tags", "size":0, "include" : "a|b" },
      "aggs":{
        "newest-event":{
          "top_hits":{ "size":1, "sort":[{ "create_time":{ "order":"desc" } }] }
        }
      }
    }
  }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:02am UTC](https://discuss.elastic.co/t/filter-out-buckets-in-an-aggregated-query/25327/4 "2017-07-06T00:02:17Z")

</div>


