How to filter by "Count of records" within Kibana Lens

[fim]

My goal is to filter by counts for a field "tracking_no" where the value inside of the field is exactly similar.

In Kibana Lens I created a simple table with a count aggregation. The table show exactly what I expect, but the goal is to filter out the Count of records = 1. Only show lines with count = 2.

Is it possible within Kibana to filter by the aggregation field in my case "Count of records"?

Alternatively I tried with a runtime field, but it doesn't what I expect:

PUT /my-*/_mapping
{
  "runtime": {
    "count_field": {
      "type": "long",
      "script": {
        "source": """
          if (doc.containsKey('sa_tracking_no.keyword') && doc['sa_tracking_no.keyword'].size() == "2") {
            emit(1L);
          } else {
            emit(0L);
          }
        """
      }
    }
  }
}

The runtime field results always in "0" even when we have pairs of documents with similar field value.

[Marta_Bondyra]

Hello,

Unfortunately, I don't think it's possible at the moment. We can only filter by non-aggregated data for now.
Runtime field solution doesn't work either because runtime field don't work between documents – they are calculated for each document separately.

[fim]

Thanks for your feedback Marta.

I found a way with a scripted query to filter by docCount.
But do you know how to implement a script in Kibana?

my-* is again the combined index.

POST /my-*/_search
{
  "size": 0,
  "query": {
    "match_all": {}
  },
  "aggs": {
    "field_value_count": {
      "terms": {
        "field": "sa_tracking_no.keyword",
        "size": 10
      },
      "aggs": {
        "doc_count_filter": {
          "bucket_selector": {
            "buckets_path": {
              "docCount": "_count"
            },
            "script": "params.docCount == 2"
          }
        }
      }
    }
  }
}

Can't believe that there is no way to filter by docCount in an index?

[Marta_Bondyra]

There's a way to do it in Vega (not trivial though, but you have a lot of flexibility there) or in TSVB (but comes with a set of disadvantages, like the invisible rows would still occupy space). Here's the example of configured panel:

We have plans to add it in the future in Lens but we're not there yet.