Filter out terms aggregation buckets in elastic search after applying aggregation

Elastic Stack Elasticsearch
1

Below is snapshot of the dataset:

recordNo             employeeId       employeeStatus   employeeAddr
   1                  employeeA        Permanent   
   2                  employeeA                             ABC
   3                  employeeB        Contract    
   4                  employeeB                             CDE

I want to get the list of employees along with employeeStatus and employeeAddr.

So I am using terms aggregation on employeeId and then using sub-aggregations of employeeStatus and employeeAddr to get these details. Below query returns the results correctly.

{
    "aggregations": {
        "Employee": {
            "terms": {
                "field": "employeeID"
            
            },
            "aggregations": {
                "employeeStatus": {
                    "terms": {"field": "employeeStatus"}
                },
                "employeeAddr": {
                    "terms": {"field": "employeeAddr"}
                }
            }
        }
    }
}

Now I want only the employees which are in Permanent status. So I am applying filter aggregation.

{
    "aggregations": {
        "filter_Employee_employeeID": {
            "filter": {
                "bool": {
                    "must": [
                        {
                            "match": {
                                "employeeStatus": {"query": "Permanent"}
                            }
                        }
                    ]
                }
            },
            "aggregations": {
                "Employee": {
                    "terms": {
                        "field": "employeeID"
                    },
                    "aggregations": {
                        "employeeStatus": {
                            "terms": {"field": "employeeStatus"}
                        },
                        "employeeAddr": {
                            "terms": {"field": "employeeAddr"}
                        }
                    }
                }
            }
        }
    }    

}

Now the problem is that the employeeAddr aggregation returns no buckets for employeeA because record 2 gets filtered out before the aggregation is done.

Assuming that I cannot modify the data set and I want to achieve the result with a single elastic query, how can I do it?

I checked the Bucket Selector pipeline aggregation but it only works for metric aggregations. Is there a way to filter out term buckets after the aggregation is applied?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.