# How to filter based on aggregation results?

**URL:** https://discuss.elastic.co/t/how-to-filter-based-on-aggregation-results/211332
**Category:** Kibana
**Created:** [December 10, 2019, 4:14pm UTC](https://discuss.elastic.co/t/how-to-filter-based-on-aggregation-results/211332 "2019-12-10T16:14:38Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![guibarati](https://avatars.discourse-cdn.com/v4/letter/g/848f3c/32.png) [@guibarati](https://discuss.elastic.co/u/guibarati)
#### Post date: [December 10, 2019, 4:14pm UTC](https://discuss.elastic.co/t/how-to-filter-based-on-aggregation-results/211332/1 "2019-12-10T16:14:39Z")

</div>

How can I filter a table view on Kibana based on the aggregation results?  
I've seen a lot of recommendations to use document count, but it doesn't work for my use case.

I have network logs where a single document indicates how much data was transferred during a tcp connection. So the field bytesReceived has the number of bytes received by a host during a connection.

On Kibana I want to create a table view with the "host" bucket and the aggregation as "sum of -\> bytes received" But I only want to see the hosts where the sum of all bytes received in the last 24 hours is: greater than, lower than or equal to a number. (With separate filters for each case)

A single document can indicate that a host "bytesReceived" in 24h was greater than X number.  
Or the sum of all "bytesReceived" for a host in multiple documents was greater than X number.

How can I filter it on Kibana table view?

To clarify, for example:  
The sum of "bytesReceived" in 100 documents could be equal 3000  
While the sum of "bytesReceived" for 2 other documents could be 4000000

And I want to show only lines where sum of "bytesReceived" are greater than 1000000 for example.

Thanks!

---

<div class="post-metadata">

### Author: ![guibarati](https://avatars.discourse-cdn.com/v4/letter/g/848f3c/32.png) [@guibarati](https://discuss.elastic.co/u/guibarati)
#### Post date: [December 11, 2019, 5:32pm UTC](https://discuss.elastic.co/t/how-to-filter-based-on-aggregation-results/211332/2 "2019-12-11T17:32:21Z")

</div>

Up! - Any advice on this?  
Please, let me know if this needs further clarification.

---

<div class="post-metadata">

### Author: ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)
#### Post date: [December 19, 2019, 1:03am UTC](https://discuss.elastic.co/t/how-to-filter-based-on-aggregation-results/211332/3 "2019-12-19T01:03:27Z")

</div>

@timroes can we please get some help here?

Thanks,  
bhavya

---

<div class="post-metadata">

### Author: ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)
#### Post date: [December 19, 2019, 10:11am UTC](https://discuss.elastic.co/t/how-to-filter-based-on-aggregation-results/211332/4 "2019-12-19T10:11:40Z")

</div>

Hi,

this is unfortunately not possible. Elasticsearch can do that via the [bucket selector](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html) aggregation, but we don't support that yet in Kibana.

You can follow [https://github.com/elastic/kibana/issues/17544](https://github.com/elastic/kibana/issues/17544) to track support for that feature in Kibana.

Cheers,  
Tim

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2020, 10:11am UTC](https://discuss.elastic.co/t/how-to-filter-based-on-aggregation-results/211332/5 "2020-01-16T10:11:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
