Filter's

[schneider (Mateus)]

how i make search for one field exe:

GET /imsva_message/_search 
{
"size":0,
      "aggs":{
          "aggdata":{
              "filter":{
                  "range":{
                      "data1":{
                          "from":"now-1h" ,
                          "to":"now"
                      }
                  }
              },
              "aggs":{
                  "aggremetente":{
                      "terms":{
                          "field":"remetente.keyword",
                          "min_doc_count":90,
                          "size":50
                      }
                  }
              }
          }
      }
}

this a server response :

{
"took" : 363,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 21535194,
"max_score" : 0.0,
"hits" : [ ]
},
"aggregations" : {
"aggdata" : {
  "doc_count" : 20187,
  "aggremetente" : {
    "doc_count_error_upper_bound" : 6,
    "sum_other_doc_count" : 1971,
    "buckets" : [
      {
        "key" : "esa",
        "doc_count" : 15526
      },
      {
        "key" : "noreply",
        "doc_count" : 483
      },
      {
        "key" : "dcdp.br",
        "doc_count" : 240
      },
      {
        "key" : "capibr",
        "doc_count" : 234
      },
      {
        "key" : "br",
        "doc_count" : 142
      }
    ]
  }
}
}
}

i wand to search that more one field ("message_direction"="incoming");

[spinscale (Alexander Reelsen)]

how about writing bool query instead of a filter aggregation. That bool query can actually contain more than one condition like

"query" : {
  "bool" : {
    "must" : [
      { "range" : {} },
      { "term" : { "message_direction" : "incoming"} },
    ]
   } 
} 

See https://www.elastic.co/guide/en/elasticsearch/reference/7.5/query-dsl-bool-query.html

[schneider (Mateus)]

Thx,I'm already using kk.

{"size":0,  
      "aggs":{
          "aggdata":{
              "filter":{
                  "bool": {
                   "filter":[
                     {"range":{"data1":{"from":"now-1h","to":"now"}}},
                     {"term": {"message_direction": "incoming"}}
                     ]
                   }
              },
              "aggs":{
                  "aggremetente":{
                      "terms":{
                          "field":"remetente.keyword",
                          "min_doc_count":0,
                          "size":10
                      }
                  }
              }
          }
      }
}