Filter search results by aggregation (cardinality > X)

Elastic Stack Elasticsearch
1

I am trying to run an ES query that uses a "cardinality" aggregation and filter the results so that I only see those with a cardinality greater than or equal to X.

This is a very basic version of my query:

"size": 0,
"query": {
    "constant_score": {
        "filter": {
            "term": {
                "foo": "bar"
            }
        }
    }
},
"aggs": {
    "agg1": {
        "terms": {
            "field": "baz",
            "order": {
                "agg2": "desc"
            }
        },
        "aggs": {
            "agg2": {
                "cardinality": {
                    "field": "baz"
                }
            },
            "filter": {
                "range": {
                    "baz": { "gte": 100 }
                }
            }
        }
    }
}

The meaning is: search for all documents that have "bar" in field "foo". Then count the distinct values all these documents have in field "baz" (the query works up to here) AND THEN only show those with more than 100 (or X) different values in the field "baz". It's the last part (only those with cardinality "gte" 100) I am struggling with.

ES returns an error:

"reason" : "[range] unknown field [baz], parser not found"

I tried different incantation of the query, inspired by various sources in the Internet, to no avail.

Can anyone point me into the correct direction?

2

You'll want to look at the bucket_selector aggregation https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.