# Filtering on aggregated values

**URL:** <https://discuss.elastic.co/t/filtering-on-aggregated-values/158576>\
**Category:** Elasticsearch\
**Created:** [November 28, 2018, 1:32pm UTC](https://discuss.elastic.co/t/filtering-on-aggregated-values/158576 "2018-11-28T13:32:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cezet](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@cezet](https://discuss.elastic.co/u/cezet)\
**Post date:** [November 28, 2018, 1:32pm UTC](https://discuss.elastic.co/t/filtering-on-aggregated-values/158576/1 "2018-11-28T13:32:42Z")

</div>

Hi all, I'm a newbie in elasticsearch, so I apologise if my question is incorrect, too simple ...  
I have a type called "individual", also have a type "income", individual has many incomes.  
income type contains fileds date and sum.

I need to build query that allows to answer next question:  
What is the count of individuals that have total income ( total income = sum of all sum field values of individual) in range {min\_range\_value} - {max\_range\_value} during the period {start\_date} - {end\_date}

Should I map theese types as parent/child or I need nested ?  
What way should I choose to implement request (filtering/scripting) ?  
Greate thanks for any ideas or keywords for googling !

{  
"query": {  
"bool": {  
"filter": [  
{  
"script": {  
"script": {  
"source": "def s = 0; for (p in params['\_source'].incomes) { s = s + p.sum; } return s \> params.min\_inco\> me\_sum;",  
"lang": "painless",  
"params": {  
"min\_income\_sum": 5000  
}  
}  
}  
}  
]  
}  
}  
}  
this query returns nothing

---

<div class="post-metadata">

**Author:** ![polyfractal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polyfractal/32/48162_2.png) [@polyfractal](https://discuss.elastic.co/u/polyfractal)\
**Post date:** [November 30, 2018, 9:25pm UTC](https://discuss.elastic.co/t/filtering-on-aggregated-values/158576/2 "2018-11-30T21:25:52Z")

</div>

How many users do you have? If you have a reasonably small number of users, you could do:

```auto
query:
  range:
    gte: start_date
    lte: end_date
aggregations:
  terms:
    field: user_id
  aggregations:
    sum:
      field: incomes
    bucket_selector:
      script: income_sums > 5000

```

E.g. a query finds all documents that are within the time range you care about. Then a `terms` aggregation partitions each user into their own bucket. For each bucket you then calculate the `sum` of the incomes, and use a `bucket_selector` pipeline aggregation to filter out any bucket that doesn't match the threshold.

Then you can count the number of remaining buckets (or use a `stats_bucket` to count them).

---

<div class="post-metadata">

**Author:** ![cezet](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@cezet](https://discuss.elastic.co/u/cezet)\
**Post date:** [December 12, 2018, 10:41am UTC](https://discuss.elastic.co/t/filtering-on-aggregated-values/158576/3 "2018-12-12T10:41:09Z")

</div>

thanks a lot!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2019, 10:41am UTC](https://discuss.elastic.co/t/filtering-on-aggregated-values/158576/4 "2019-01-09T10:41:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.