# Filtering by a aggregation (like SQL having clause)

**URL:** <https://discuss.elastic.co/t/filtering-by-a-aggregation-like-sql-having-clause/151281>\
**Category:** Elasticsearch\
**Created:** [October 5, 2018, 9:14pm UTC](https://discuss.elastic.co/t/filtering-by-a-aggregation-like-sql-having-clause/151281 "2018-10-05T21:14:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lucas\_Porto](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lucas\_Porto](https://discuss.elastic.co/u/Lucas_Porto)\
**Post date:** [October 5, 2018, 9:14pm UTC](https://discuss.elastic.co/t/filtering-by-a-aggregation-like-sql-having-clause/151281/1 "2018-10-05T21:14:56Z")

</div>

Hi all,  
My question is quite simple I think.

I have the query below where I use two types of aggregations. The query works fine.

```auto
GET /testeagg/_search
{
  "aggregations": {
	"group_by_id": {
	  "aggregations": {	
             "sum_qtd_item": {
                  "sum": { "field": "activities.qtd_itens" } }  
          }, 
  	  "terms": {"field": "id_single_profile", "order": {"sum_qtd_item": "desc"	} }
	}
  }, 
  "ext": {}, 
  "query": { "match_all": {} }, 
  "size": 0
}

```

My output:

```auto
"aggregations": {
    "group_by_id": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": 555,
          "doc_count": 1,
          "sum_qtd_item": {
            "value": 6
          }
        },
        {
          "key": 999,
          "doc_count": 1,
          "sum_qtd_item": {
            "value": 6
          }
        },
        {
          "key": 123,
          "doc_count": 1,
          "sum_qtd_item": {
            "value": 3
          }
        },
        {
          "key": 666,
          "doc_count": 1,
          "sum_qtd_item": {
            "value": 0
          }
        }
      ]
    }
  }

```

All I need to do now is apply an filter in aggregation value (like we used to do by using HAVING clause in SQL).  
For example, return all the keys with `sum(activities.qtd_itens) > 3`.

I tried to use filter+range without success. I don't know where is the exactly place I need to put the line below.  
`"filter": {	"range": { "sum_qtd_item": { "gte": 3 }	} }`

I'll appreciate if anyone can help me with this.

Thanks!

---

<div class="post-metadata">

**Author:** ![shanec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shanec/32/4004_2.png) [@shanec](https://discuss.elastic.co/u/shanec)\
**Post date:** [October 6, 2018, 8:22pm UTC](https://discuss.elastic.co/t/filtering-by-a-aggregation-like-sql-having-clause/151281/2 "2018-10-06T20:22:10Z")

</div>

Have a look at the [bucket selector aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html)

---

<div class="post-metadata">

**Author:** ![Lucas\_Porto](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lucas\_Porto](https://discuss.elastic.co/u/Lucas_Porto)\
**Post date:** [October 8, 2018, 2:24pm UTC](https://discuss.elastic.co/t/filtering-by-a-aggregation-like-sql-having-clause/151281/3 "2018-10-08T14:24:28Z")

</div>

Thanks man! Bucket selector worked for me.

But It was needed to change the type of a field. The "activities" is a nested field now. So I need to do the necessary changes in my query.

Do I need to use the "nested" tag as a new aggregation form? Or between one of my existing aggs?

Here's my query:

```auto
GET testeagg/_search
{
  "aggregations": {
    "group_by_id": {
      "aggregations": {
        "sum_qtd_item": {
          "sum": {
            "field": "activities.qtd_itens"
          }
        },
        "sales_bucket_filter": {
          "bucket_selector": {
            "buckets_path": {
              "sum_qtd_item": "sum_qtd_item"
            },
            "script": "params.sum_qtd_item >= 1"
          }
        }
      },
      "terms": {
        "field": "id_single_profile",
        "order": {
          "sum_qtd_item": "desc"
        }
      }
    }
  },
  "ext": {},
  "query": {
    "match_all": {}
  },
  "size": 0
}

```

Thanks!

---

<div class="post-metadata">

**Author:** ![Lucas\_Porto](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lucas\_Porto](https://discuss.elastic.co/u/Lucas_Porto)\
**Post date:** [October 8, 2018, 7:35pm UTC](https://discuss.elastic.co/t/filtering-by-a-aggregation-like-sql-having-clause/151281/4 "2018-10-08T19:35:40Z")

</div>

I just found a solution here.

Here's my query final version.

```auto
GET /audience-3c9b46e4-1b10-4ad4-9a68-ae371034adfe/_search
{
  "aggs": {
    "group_by_id_single_profile": {
      "terms": {
        "field": "id_single_profile", "size": 10000
      },
      "aggs": {
        "nested_field": {
          "nested": {
            "path": "activities"
          },
          "aggs": {
            "sum_field": {
              "sum": {
                "field": "activities.qt_items"
              }
            }
          }
        },
        "FindIt": {
          "bucket_selector": {
            "buckets_path": {
              "sum_field": "nested_field&gt;sum_field"
            },
            "script": "params.sum_field &gt;= 5 &amp;&amp; params.sum_field &lt;= 10"
          }
        }
      }
    }
  },
  "query": {
    "nested": {
      "path": "activities",
      "query": {
         "bool": {
            "should": [
            { "match": { "activities.ds_action": "Comprou" }},
            { "match": { "activities.nm_product": "Edição 115 anos - 13/10/2018" }}
            ]
      }
    }
  }
  },
  "size": 0
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2018, 7:35pm UTC](https://discuss.elastic.co/t/filtering-by-a-aggregation-like-sql-having-clause/151281/5 "2018-11-05T19:35:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.