# How to Post Filter Aggregation List

**URL:** <https://discuss.elastic.co/t/how-to-post-filter-aggregation-list/70486>\
**Category:** Elasticsearch\
**Created:** [January 3, 2017, 10:24pm UTC](https://discuss.elastic.co/t/how-to-post-filter-aggregation-list/70486 "2017-01-03T22:24:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![krmathieu](https://avatars.discourse-cdn.com/v4/letter/k/b5e925/32.png) [@krmathieu](https://discuss.elastic.co/u/krmathieu)\
**Post date:** [January 3, 2017, 10:24pm UTC](https://discuss.elastic.co/t/how-to-post-filter-aggregation-list/70486/1 "2017-01-03T22:24:41Z")

</div>

I am running the following aggregation query and it is returning the expected results. However, it is also returning a bunch of non-desired facets. This is because there can be one or more org objects per document (with at least one matching the query syntax of course) and they were NOT indexed as nested objects so all org.normalized values for a matching document get counted as part of the aggregation. My question is, can I do some post/sub-query type of thing and/or a sub-aggregation to get the desired results (all org.normalized value ending with a &)? Any help that anyone may be able to provide would be appreciated. Thanks.

Kevin

```
{
    "size": 0,
    "aggs" : {
        "names" : {
            "filter" : { "regexp": { "orgs.normalized": ".*[&]" } },
            "aggs" : {
                "filteredNames" : { "terms": {"field" : "orgs.normalized", "size": 100} }
            }
        }
    }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2017, 10:24pm UTC](https://discuss.elastic.co/t/how-to-post-filter-aggregation-list/70486/2 "2017-01-31T22:24:45Z")

</div>

Closed on January 31, 2017, 10:24pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.