# Filtering two different nested fields in the same agg

**URL:** <https://discuss.elastic.co/t/filtering-two-different-nested-fields-in-the-same-agg/328169>\
**Category:** Elasticsearch\
**Tags:** eql-elastic-query-language\
**Created:** [March 21, 2023, 1:55pm UTC](https://discuss.elastic.co/t/filtering-two-different-nested-fields-in-the-same-agg/328169 "2023-03-21T13:55:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ndtreviv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ndtreviv/32/22494_2.png) [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\
**Post date:** [March 21, 2023, 1:55pm UTC](https://discuss.elastic.co/t/filtering-two-different-nested-fields-in-the-same-agg/328169/1 "2023-03-21T13:55:39Z")

</div>

I understand how to filter on two nested fields using sub aggregations and get individual `doc_count`s out of them, but I want to filter and count one nested field by the value of another nested field.

eg:  
Imagine a document structure:

```auto
{
    some_other_property: "value",
    image: [{
        classification: [{
            label: "xyz",
            probability: 0.00,
        }],
        check: {
            flag: true
        }
    }]
}

```

I've contrived the field names slightly.

I want to count the total sum of all `image` nested fields across all documents that have a specific label and probability and where the check flag is a specific value as well.

Is this even possible?

It seems that only a nested agg (`{ "aggs": { "nested": ...}}`) will properly count the nested image documents. Anything else just counts the parent document, but this, for example:

```auto
{
  "size": 0,
  "aggs": {
    "classification": {
      "nested": {
        "path": "image.classification"
      },
      "aggs": {
        "images": {
          "filter": {
            "bool": {
              "filter": [
                {
                  "match_phrase": {
                    "image.classification.label": "other"
                  }
                },
                {
                  "range": {
                    "image.classification.probability": {
                      "gte": "0.9"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "check": {
              "nested": {
                "path": "image.check"
              },
              "aggs": {
                "known": {
                  "filter": {
                    "term": {
                      "image.check.flag": false
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

```

Returns something like this:

```auto
"aggregations" : {
    "classification" : {
      "doc_count" : 3414,
      "images" : {
        "doc_count" : 1107,
        "check" : {
          "doc_count" : 0,
          "known" : {
            "doc_count" : 0
          }
        }
      }
    }
  }

```

I know for a fact that `check` and `known` should certainly be above 0.

Thanks for any help offered!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2023, 1:56pm UTC](https://discuss.elastic.co/t/filtering-two-different-nested-fields-in-the-same-agg/328169/2 "2023-04-18T13:56:24Z")

</div>

Closed on April 18, 2023, 1:56pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.