Filter search results by aggregation (cardinality > X)

[andreas_es]

I am trying to run an ES query that uses a "cardinality" aggregation and filter the results so that I only see those with a cardinality greater than or equal to X.

This is a very basic version of my query:

"size": 0,
"query": {
    "constant_score": {
        "filter": {
            "term": {
                "foo": "bar"
            }
        }
    }
},
"aggs": {
    "agg1": {
        "terms": {
            "field": "baz",
            "order": {
                "agg2": "desc"
            }
        },
        "aggs": {
            "agg2": {
                "cardinality": {
                    "field": "baz"
                }
            },
            "filter": {
                "range": {
                    "baz": { "gte": 100 }
                }
            }
        }
    }
}

The meaning is: search for all documents that have "bar" in field "foo". Then count the distinct values all these documents have in field "baz" (the query works up to here) AND THEN only show those with more than 100 (or X) different values in the field "baz". It's the last part (only those with cardinality "gte" 100) I am struggling with.

ES returns an error:

"reason" : "[range] unknown field [baz], parser not found"

I tried different incantation of the query, inspired by various sources in the Internet, to no avail.

Can anyone point me into the correct direction?

[jpountz (Adrien Grand)]

You'll want to look at the bucket_selector aggregation https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html