# Filters on Aggregation not working
**URL:** https://discuss.elastic.co/t/filters-on-aggregation-not-working/23129
**Category:** Elasticsearch
**Created:** [April 7, 2015, 12:59pm UTC](https://discuss.elastic.co/t/filters-on-aggregation-not-working/23129 "2015-04-07T12:59:57Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@rakesh\_rakshit](https://discuss.elastic.co/u/rakesh_rakshit)
#### Post date: [April 7, 2015, 12:59pm UTC](https://discuss.elastic.co/t/filters-on-aggregation-not-working/23129/1 "2015-04-07T12:59:57Z")
Hi all,
I am using ES 1.2.1.
I have the following type of data:
{"splashView":"Y","orderPlaced":"Y","timestamp":"1428402321850","parsed":"true","type":"cpeevent"}
{"splashView":"Y","orderPlaced":"N","timestamp":"1428402322100","parsed":"true","type":"cpeevent"}
The mapping for these fields are:
"splashView":
{
"type": "string",
"store": true,
"analyzer": "standard"
},
"orderPlaced":
{
"type": "string",
"store": true,
"analyzer": "standard"
},
I am performing the following query:
{
"aggs" : {
"splashcount" : {
"filters" : {
"filters" : {
"orderPlaced1" : { "term" : { "orderPlaced" : "Y" }},
"splashView1" : { "term" : { "splashView" : "Y" }}
}
}
}
}
}
But not getting any response:
{
"took": 3,
"timed\_out": false,
"\_shards":
{
"total": 5,
"successful": 5,
"failed": 0
},
"hits":
{
"total": 11,
"max\_score": 1,
"aggregations":
{
"splashcount":
{
"buckets":
{
"orderPlaced1":
{
"doc\_count": 0
},
"splashView1":
{
"doc\_count": 0
}
}
}
}
}
Can anyone tell me why I am not getting doc count when the data matching
the filter is there?
Regards,
Rakesh Kumar Rakshit
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/1a70b439-ed94-4e8c-a0e9-25d146ea896f%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1a70b439-ed94-4e8c-a0e9-25d146ea896f%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@colings86](https://discuss.elastic.co/u/colings86)
#### Post date: [April 7, 2015, 2:16pm UTC](https://discuss.elastic.co/t/filters-on-aggregation-not-working/23129/2 "2015-04-07T14:16:43Z")
HI Rakesh,
Term filters do not get passed through the analyzer and so need to specify
the term as it appears in the index. Since you are using the standard
analyzer your `orderPlaced` and `splashView` will have `Y` indexed as `y`
because the standard analyzer lowercases all terms. This is most likely to
be your issue. You can do one of the following to solve this:
1. Change your query to reflect the terms as they appear in the index:
{
"aggs" : {
"splashcount" : {
"filters" : {
"filters" : {
"orderPlaced1" : { "term" : { "orderPlaced" : "y" }},
"splashView1" : { "term" : { "splashView" : "y" }}
}
}
}
}
}
1. Change the mapping on those fields to specify `"index": "not_analyzed"`
(more info here
"[Mapping | Elasticsearch: The Definitive Guide [2.x] | Elastic](http://www.elastic.co/guide/en/elasticsearch/guide/current/mapping-intro.html#_index_2)")
and keep your query the same. Note that this will require that you re-index
your data as this setting on the mapping cannot be updated on an existing
index
2. Use the Boolean field type
([Field data types | Elasticsearch Guide [8.11] | Elastic](http://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-core-types.html#boolean)).
Note that this will also require re-indexing your data
Hope this helps,
Colin
On Tuesday, April 7, 2015 at 1:59:57 PM UTC+1, rakesh rakshit wrote:
> Hi all,
>
> I am using ES 1.2.1.
>
> I have the following type of data:
>
> {"splashView":"Y","orderPlaced":"Y","timestamp":"1428402321850","parsed":"true","type":"cpeevent"}
>
> {"splashView":"Y","orderPlaced":"N","timestamp":"1428402322100","parsed":"true","type":"cpeevent"}
>
> The mapping for these fields are:
>
> "splashView":
> {
> "type": "string",
> "store": true,
> "analyzer": "standard"
> },
>
> "orderPlaced":
> {
> "type": "string",
> "store": true,
> "analyzer": "standard"
> },
>
> I am performing the following query:
>
> {
> "aggs" : {
> "splashcount" : {
> "filters" : {
> "filters" : {
> "orderPlaced1" : { "term" : { "orderPlaced" : "Y" }},
> "splashView1" : { "term" : { "splashView" : "Y" }}
> }
> }
> }
> }
> }
>
> But not getting any response:
>
> {
> "took": 3,
> "timed\_out": false,
> "\_shards":
> {
> "total": 5,
> "successful": 5,
> "failed": 0
> },
> "hits":
> {
> "total": 11,
> "max\_score": 1,
>
> "aggregations":
> {
> "splashcount":
> {
> "buckets":
> {
> "orderPlaced1":
> {
> "doc\_count": 0
> },
> "splashView1":
> {
> "doc\_count": 0
> }
> }
> }
> }
> }
>
> Can anyone tell me why I am not getting doc count when the data matching
> the filter is there?
>
> Regards,
> Rakesh Kumar Rakshit
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/2737b591-ab70-413b-a368-9af9f2066e16%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/2737b591-ab70-413b-a368-9af9f2066e16%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@rakesh\_rakshit](https://discuss.elastic.co/u/rakesh_rakshit)
#### Post date: [April 7, 2015, 2:47pm UTC](https://discuss.elastic.co/t/filters-on-aggregation-not-working/23129/3 "2015-04-07T14:47:57Z")
Thanks a lot Colin. Changing to lower case helped me.
Regards,
Rakesh
On Tuesday, April 7, 2015 at 7:46:43 PM UTC+5:30, Colin Goodheart-Smithe
wrote:
> HI Rakesh,
>
> Term filters do not get passed through the analyzer and so need to specify
> the term as it appears in the index. Since you are using the standard
> analyzer your `orderPlaced` and `splashView` will have `Y` indexed as `y`
> because the standard analyzer lowercases all terms. This is most likely to
> be your issue. You can do one of the following to solve this:
>
> 1. Change your query to reflect the terms as they appear in the index:
>
> {
> "aggs" : {
> "splashcount" : {
> "filters" : {
> "filters" : {
> "orderPlaced1" : { "term" : { "orderPlaced" : "y" }},
> "splashView1" : { "term" : { "splashView" : "y" }}
> }
> }
> }
> }
> }
>
> 1. Change the mapping on those fields to specify `"index": "not_analyzed"`
> (more info here "
> [Mapping | Elasticsearch: The Definitive Guide [2.x] | Elastic](http://www.elastic.co/guide/en/elasticsearch/guide/current/mapping-intro.html#_index_2)")
> and keep your query the same. Note that this will require that you re-index
> your data as this setting on the mapping cannot be updated on an existing
> index
>
> 2. Use the Boolean field type (
> [Field data types | Elasticsearch Guide [8.11] | Elastic](http://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-core-types.html#boolean)).
> Note that this will also require re-indexing your data
>
> Hope this helps,
>
> Colin
>
> On Tuesday, April 7, 2015 at 1:59:57 PM UTC+1, rakesh rakshit wrote:
>
> > Hi all,
> >
> > I am using ES 1.2.1.
> >
> > I have the following type of data:
> >
> > {"splashView":"Y","orderPlaced":"Y","timestamp":"1428402321850","parsed":"true","type":"cpeevent"}
> >
> > {"splashView":"Y","orderPlaced":"N","timestamp":"1428402322100","parsed":"true","type":"cpeevent"}
> >
> > The mapping for these fields are:
> >
> > "splashView":
> > {
> > "type": "string",
> > "store": true,
> > "analyzer": "standard"
> > },
> >
> > "orderPlaced":
> > {
> > "type": "string",
> > "store": true,
> > "analyzer": "standard"
> > },
> >
> > I am performing the following query:
> >
> > {
> > "aggs" : {
> > "splashcount" : {
> > "filters" : {
> > "filters" : {
> > "orderPlaced1" : { "term" : { "orderPlaced" : "Y" }},
> > "splashView1" : { "term" : { "splashView" : "Y" }}
> > }
> > }
> > }
> > }
> > }
> >
> > But not getting any response:
> >
> > {
> > "took": 3,
> > "timed\_out": false,
> > "\_shards":
> > {
> > "total": 5,
> > "successful": 5,
> > "failed": 0
> > },
> > "hits":
> > {
> > "total": 11,
> > "max\_score": 1,
> >
> > "aggregations":
> > {
> > "splashcount":
> > {
> > "buckets":
> > {
> > "orderPlaced1":
> > {
> > "doc\_count": 0
> > },
> > "splashView1":
> > {
> > "doc\_count": 0
> > }
> > }
> > }
> > }
> > }
> >
> > Can anyone tell me why I am not getting doc count when the data matching
> > the filter is there?
> >
> > Regards,
> > Rakesh Kumar Rakshit
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/76ef7773-ff03-4150-886d-c9db00943baa%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/76ef7773-ff03-4150-886d-c9db00943baa%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:21am UTC](https://discuss.elastic.co/t/filters-on-aggregation-not-working/23129/4 "2017-07-06T00:21:08Z")