# How to remove hits after aggregation

**URL:** <https://discuss.elastic.co/t/how-to-remove-hits-after-aggregation/360735>\
**Category:** Elasticsearch\
**Tags:** aggregations\
**Created:** [June 3, 2024, 3:52pm UTC](https://discuss.elastic.co/t/how-to-remove-hits-after-aggregation/360735 "2024-06-03T15:52:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![p4charu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/p4charu/32/113392_2.png) [@p4charu](https://discuss.elastic.co/u/p4charu)\
**Post date:** [June 3, 2024, 3:52pm UTC](https://discuss.elastic.co/t/how-to-remove-hits-after-aggregation/360735/1 "2024-06-03T15:52:51Z")

</div>

Hello,  
I'm trying to do an aggregate query to get issues at their highest state but if the highest state is 'closed' then I want to completely ignore the issue. For example,

```auto
docId action issue
Doc1 raised issue1
Doc2 solved issue1
Doc3 raised issue2
Doc4 solved issue2
Doc5 closed issue1
Doc6 raised issue3

```

I want the users to see all issues at their highest state but if the highest state is closed I want to hide the issue completely.

Expected result:

```auto
Id action issue
Doc4 solved issue2
Doc6 raised issue3

```

Can this be done?  
Anyhelp is highly appreciated.  
Thank you.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 3, 2024, 4:16pm UTC](https://discuss.elastic.co/t/how-to-remove-hits-after-aggregation/360735/2 "2024-06-03T16:16:54Z")

</div>

May be an idea would be something like:

```auto
DELETE test
PUT test
{
  "mappings": {
    "properties": {
      "action": {
        "type": "keyword"
      },
      "issue": {
        "type": "keyword"
      }
    }
  }
}
PUT test/_doc/Doc1
{
  "action": "1-raised", "issue": "issue1"
}
PUT test/_doc/Doc2
{
  "action": "2-solved", "issue": "issue1"
}
PUT test/_doc/Doc3
{
  "action": "1-raised", "issue": "issue2"
}
PUT test/_doc/Doc4
{
  "action": "2-solved", "issue": "issue2"
}
PUT test/_doc/Doc5
{
  "action": "3-closed", "issue": "issue1"
}
PUT test/_doc/Doc6
{
  "action": "1-raised", "issue": "issue3"
}

GET /test/_search?filter_path=aggregations.issue.buckets.key,aggregations.issue.buckets.action.buckets.key
{
 "size": 0,
 "aggs": {
   "issue": {
     "terms": {
       "field": "issue"
     },
     "aggs": {
       "action": {
         "terms": {
           "field": "action",
           "order": {
             "_key": "desc"
           },
           "size": 1
         }
       }
     }
   }
 }
}

```

Which produces:

```auto
{
  "aggregations": {
    "issue": {
      "buckets": [
        {
          "key": "issue1",
          "action": {
            "buckets": [
              {
                "key": "3-closed"
              }
            ]
          }
        },
        {
          "key": "issue2",
          "action": {
            "buckets": [
              {
                "key": "2-solved"
              }
            ]
          }
        },
        {
          "key": "issue3",
          "action": {
            "buckets": [
              {
                "key": "1-raised"
              }
            ]
          }
        }
      ]
    }
  }
}

```

But you then need to manually exclude the first one as it contains `3-closed`.

At least, it's a "start"... 😉

---

<div class="post-metadata">

**Author:** ![p4charu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/p4charu/32/113392_2.png) [@p4charu](https://discuss.elastic.co/u/p4charu)\
**Post date:** [June 4, 2024, 1:54pm UTC](https://discuss.elastic.co/t/how-to-remove-hits-after-aggregation/360735/3 "2024-06-04T13:54:31Z")

</div>

Thank you for trying 🙂  
Unfortunately, I need a one-step solution.

---

<div class="post-metadata">

**Author:** ![p4charu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/p4charu/32/113392_2.png) [@p4charu](https://discuss.elastic.co/u/p4charu)\
**Post date:** [June 4, 2024, 1:59pm UTC](https://discuss.elastic.co/t/how-to-remove-hits-after-aggregation/360735/4 "2024-06-04T13:59:22Z")

</div>

Hello again!  
I found this on stackoverflow. It's very similar to the situation I am in.

> <https://stackoverflow.com/questions/61266158/is-there-any-way-to-apply-post-filter-in-elasticsearch-on-only-aggregated-result>

This solved my problem. I was also able to include the top hit inside the bucket with the top\_hits aggregation.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 4, 2024, 2:45pm UTC](https://discuss.elastic.co/t/how-to-remove-hits-after-aggregation/360735/5 "2024-06-04T14:45:41Z")

</div>

Great. Would you mind sharing your final example, in the same way I did? So we can mark this as solved with a nice solution people can run later.

---

<div class="post-metadata">

**Author:** ![p4charu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/p4charu/32/113392_2.png) [@p4charu](https://discuss.elastic.co/u/p4charu)\
**Post date:** [June 5, 2024, 2:00pm UTC](https://discuss.elastic.co/t/how-to-remove-hits-after-aggregation/360735/6 "2024-06-05T14:00:41Z")

</div>

Unfortunately, I can not share my elastic query due to company restrictions. But it is similar to this: [kibana - is there any way to apply post filter in Elasticsearch on only aggregated result on on all the document? - Stack Overflow](https://stackoverflow.com/questions/61266158/is-there-any-way-to-apply-post-filter-in-elasticsearch-on-only-aggregated-result)