# Get only buckets from one aggregation type and remove the rest

**URL:** https://discuss.elastic.co/t/get-only-buckets-from-one-aggregation-type-and-remove-the-rest/45954
**Category:** Elasticsearch
**Created:** [March 31, 2016, 2:44pm UTC](https://discuss.elastic.co/t/get-only-buckets-from-one-aggregation-type-and-remove-the-rest/45954 "2016-03-31T14:44:22Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![krum](https://avatars.discourse-cdn.com/v4/letter/k/a88e57/32.png) [@krum](https://discuss.elastic.co/u/krum)
#### Post date: [March 31, 2016, 2:44pm UTC](https://discuss.elastic.co/t/get-only-buckets-from-one-aggregation-type-and-remove-the-rest/45954/1 "2016-03-31T14:44:22Z")

</div>

Hi,  
Only buckets from one aggregation are needed ( "SumMaxT" - "sum\_bucket"). Aggregation terms\_H and it’s child MaxT should not be returned. I have tried bucket\_selector but the result is not good - terms aggregations are still there and sum\_bucket returning 0

The search:  
GET \_search  
{  
"size": 0,  
"query": {  
"filtered": {  
"query": {  
"query\_string": {  
"analyze\_wildcard": true,  
"query": "5"  
}  
},  
"filter": {  
"bool": {  
"must": [  
{  
"range": {  
"timeStamp": {  
"gte": 1447948755793,  
"lte": 1447950175440,  
"format": "epoch\_millis"  
}  
}  
}  
]  
}  
}  
}  
},  
"aggs": {  
"2": {  
"date\_histogram": {  
"interval": "1s",  
"field": "timeStamp",  
"min\_doc\_count": 1,  
"extended\_bounds": {  
"min": "1447948755793",  
"max": "1447950175440"  
}  
},  
"aggs": {  
"terms\_H": {  
"terms": {  
"field": "Hostname",  
"size": 2,  
"order": {  
"\_term": "desc"  
}  
},  
"aggs": {  
"MaxT": {  
"max": {  
"field": "allThreads"  
}  
}  
}  
},  
"SumMaxT": {  
"sum\_bucket": {  
"buckets\_path": "terms\_H\>MaxT"  
}  
}  
}  
}  
}  
}

The result:  
"aggregations": {  
"2": {  
"buckets": [  
{  
"key\_as\_string": "1447949006000",  
"key": 1447949006000,  
"doc\_count": 11,  
"terms\_H": {  
"doc\_count\_error\_upper\_bound": 0,  
"sum\_other\_doc\_count": 7,  
"buckets": [  
{  
"key": "Server5",  
"doc\_count": 1,  
"MaxT": {  
"value": 5  
}  
},  
{  
"key": "Server4",  
"doc\_count": 3,  
"MaxT": {  
"value": 5  
}  
}  
]  
},  
"SumMaxT": {  
"value": 10  
}  
},  
...  
]  
}  
}

Please advise how to keep the correct SumMaxT values and remove entirely terms\_H!

Thanks in advance  
Krum

---

<div class="post-metadata">

### Author: ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)
#### Post date: [April 1, 2016, 8:05am UTC](https://discuss.elastic.co/t/get-only-buckets-from-one-aggregation-type-and-remove-the-rest/45954/2 "2016-04-01T08:05:21Z")

</div>

You could use the response filtering feature to remove the parts of the response you do not need: [https://www.elastic.co/guide/en/elasticsearch/reference/2.3/common-options.html#\_response\_filtering](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/common-options.html#_response_filtering)

---

<div class="post-metadata">

### Author: ![krum](https://avatars.discourse-cdn.com/v4/letter/k/a88e57/32.png) [@krum](https://discuss.elastic.co/u/krum)
#### Post date: [April 1, 2016, 3:27pm UTC](https://discuss.elastic.co/t/get-only-buckets-from-one-aggregation-type-and-remove-the-rest/45954/3 "2016-04-01T15:27:08Z")

</div>

Thank you Colin,  
It's OK now!

Best Regards  
Krum

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:03pm UTC](https://discuss.elastic.co/t/get-only-buckets-from-one-aggregation-type-and-remove-the-rest/45954/4 "2017-07-05T23:03:11Z")

</div>