# How can I filter for a specific field value in this query?

**URL:** <https://discuss.elastic.co/t/how-can-i-filter-for-a-specific-field-value-in-this-query/140858>\
**Category:** Elasticsearch\
**Created:** [July 20, 2018, 8:33am UTC](https://discuss.elastic.co/t/how-can-i-filter-for-a-specific-field-value-in-this-query/140858 "2018-07-20T08:33:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [July 20, 2018, 8:33am UTC](https://discuss.elastic.co/t/how-can-i-filter-for-a-specific-field-value-in-this-query/140858/1 "2018-07-20T08:33:46Z")

</div>

Hi,

I made this query and it gives me the results I'm looking for however I want to get the SUM where field wan\_int matches wan1 (I got multiple wan interfaces). I tried adding filters and a query but I can't get it to work.

```auto
{
 "size":"0",
    "aggs": {
        "range": {
            "date_range": {
                "field": "@timestamp",
                "format": "YYYY/MM/DD, HH:mm:ss",
                "ranges": [
                    { "from": "now/1M" } 
                ]
            },
    "aggs" : {
        "switch_location" : {
            "terms" : {
                "field" : "location"
            },
            "aggs" : {
            "total_bytes": {
            "sum": {
            "script" : "doc['in_bytes'].value + doc['out_bytes'].value"
         }
       }
      }
     }
    }
   }
 }
}
```

---

<div class="post-metadata">

**Author:** ![mikebd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mikebd/32/33437_2.png) [@mikebd](https://discuss.elastic.co/u/mikebd)\
**Post date:** [July 20, 2018, 1:28pm UTC](https://discuss.elastic.co/t/how-can-i-filter-for-a-specific-field-value-in-this-query/140858/2 "2018-07-20T13:28:24Z")

</div>

```auto
{
 "size":"0",
	"query": {
		"bool": {
			"filter": {
				"match": {
					"wan_int": "wan1"
				}
			}
		}
	},
    "aggs": {
        "range": {
            "date_range": {
                "field": "@timestamp",
                "format": "YYYY/MM/DD, HH:mm:ss",
                "ranges": [
                    { "from": "now/1M" } 
                ]
            },
    "aggs" : {
        "switch_location" : {
            "terms" : {
                "field" : "location"
            },
            "aggs" : {
            "total_bytes": {
            "sum": {
            "script" : "doc['in_bytes'].value + doc['out_bytes'].value"
         }
       }
      }
     }
    }
   }
 }
}

```

---

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [July 23, 2018, 12:27am UTC](https://discuss.elastic.co/t/how-can-i-filter-for-a-specific-field-value-in-this-query/140858/3 "2018-07-23T00:27:13Z")

</div>

Thanks, that works.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2018, 12:27am UTC](https://discuss.elastic.co/t/how-can-i-filter-for-a-specific-field-value-in-this-query/140858/4 "2018-08-20T00:27:21Z")

</div>

Closed on August 20, 2018, 12:27am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.