# Filter\_path usage in multi-search

**URL:** <https://discuss.elastic.co/t/filter-path-usage-in-multi-search/370822>\
**Category:** Elasticsearch\
**Created:** [November 20, 2024, 9:00am UTC](https://discuss.elastic.co/t/filter-path-usage-in-multi-search/370822 "2024-11-20T09:00:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sevdog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sevdog/32/139358_2.png) [@sevdog](https://discuss.elastic.co/u/sevdog)\
**Post date:** [November 20, 2024, 9:00am UTC](https://discuss.elastic.co/t/filter-path-usage-in-multi-search/370822/1 "2024-11-20T09:00:25Z")

</div>

Hello everybody, i recenlty started using the `filter_path` parameter ([Common options | Elasticsearch Guide [8.16] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/common-options.html#common-options-response-filtering)) to reduce output of a msearch performed on some metricbeat indicies: the first search looks for CPU usage and the second for the network traffic regarding a subset of network interfaces.

When there is no traffic (because there are no related interfaces) the second search is completely filtered out when using filter\_path, while it is returned when that parameter is not returned.

Here is a sample query:

```auto
GET metricbeat-*/_msearch?filter_path=responses.aggregations
{}
{
    "query": {
        "bool": {
            "must": [
                {"range": {"@timestamp": {"gte": "now-24h", "lte": "now"}}},
                {"term": {"host.name": "sensor_xyz"}}
            ],
            "filter": [
                {"term": {"metricset.name": "load"}}
            ]
        }
    },
    "aggs": {
        "by_day": {
            "date_histogram": {
                "field": "@timestamp",
                "fixed_interval": "10m"
            },
            "aggs": {
                "average": {
                    "avg": {
                        "field": "system.load.norm.5"
                    }
                }
            }
        }
    },
    "size": 0
}
 {}
 {
    "query": {
        "bool": {
            "must": [
                {"range": {"@timestamp": {"gte": "now-24h", "lte": "now"}}},
                {"term": {"host.name": "sensor_xyz"}}
            ],
            "filter": [
                {"term": {"metricset.name": "network"}},
                {"terms": {"system.network.name": []}}
            ]
        }
    },
    "aggs": {
        "ifaces": {
            "terms": {
                "field": "system.network.name"
            },
            "aggs": {
                "interval": {
                    "date_histogram": {
                        "field": "@timestamp",
                        "fixed_interval": "10m"
                    },
                    "aggs": {
                        "traffic_peak": {"max": {"field": "system.network.in.bytes"}},
                        "traffic_instant": {
                            "derivative": {"buckets_path": "traffic_peak","gap_policy": "skip","unit": "1s"}
                        }
                    }
                }
            }
        }
    },
    "size": 0
}

```

Is this an expected result? I tried to extend the fields allowed by `filter_path` without success, it seems that the fact that it is an empty search filters it out.

In this case the problem is caused by my own query which will produce 0 results in the second search, however I am concerned that this may occur also when there are no result for a particular query. With msearch this is very bad because the order and the number of responses is important to recognize the results.

---

<div class="post-metadata">

**Author:** ![sevdog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sevdog/32/139358_2.png) [@sevdog](https://discuss.elastic.co/u/sevdog)\
**Post date:** [November 21, 2024, 8:10am UTC](https://discuss.elastic.co/t/filter-path-usage-in-multi-search/370822/2 "2024-11-21T08:10:31Z")

</div>

To be more specific: I also use a "remove field" in the `filter_path` param.

```auto
?filter_path=responses.aggregations,-responses.aggregations.**.*doc_count*

```