# How to use aggregations with filter?

**URL:** <https://discuss.elastic.co/t/how-to-use-aggregations-with-filter/19466>\
**Category:** Elasticsearch\
**Created:** [August 26, 2014, 4:50pm UTC](https://discuss.elastic.co/t/how-to-use-aggregations-with-filter/19466 "2014-08-26T16:50:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Markus\_Breuer](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@Markus\_Breuer](https://discuss.elastic.co/u/Markus_Breuer)\
**Post date:** [August 26, 2014, 4:50pm UTC](https://discuss.elastic.co/t/how-to-use-aggregations-with-filter/19466/1 "2014-08-26T16:50:06Z")

</div>

kibana uses a facet to capture the result set. I want to use an  
aggregation to fetch the same result.

The original query from kibana looks like this:

{  
"facets" : {  
"0" : {  
"date\_histogram" : {  
"field" : "@timestamp",  
"interval" : "1d"  
},  
"global" : true,  
"facet\_filter" : {  
"fquery" : {  
"query" : {  
"filtered" : {  
"query" : {  
"query\_string" : {  
"query" : "result:SUCCESS"  
}  
},  
"filter" : {  
"bool" : {  
"must" : [{  
"range" : {  
"@timestamp" : {  
"from" : 1393137170765,  
"to" : 1396195200000  
}  
}  
}  
]  
}  
}  
}  
}  
}  
}  
}  
},  
"size" : 0  
}

The aggregation without filter critera is here:

{  
"aggregations": {  
"0": {  
"date\_histogram": {  
"field": "@timestamp",  
"interval": "1d"  
}  
}  
},  
"size": 0  
}

But how should the filter criteria be applied here? In mailinglist  
archive I found a reference to  
[http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filter-aggregation.html](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filter-aggregation.html).

I created the following query which seems to return result. Is this the  
correct way to filter aggregated data?

{  
"aggs": {  
"timerange": {  
"filter": {  
"range": {  
"@timestamp": {  
"gt": 0  
}  
}  
},  
"aggregations": {  
"0": {  
"date\_histogram": {  
"field": "@timestamp",  
"interval": "1d"  
}  
}  
}  
}  
},  
"size": 0  
}

Is this the best/most performant way to capture data from large index?  
Or are there alternatives?

---

<div class="post-metadata">

**Author:** ![Markus\_Breuer](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@Markus\_Breuer](https://discuss.elastic.co/u/Markus_Breuer)\
**Post date:** [September 1, 2014, 4:07pm UTC](https://discuss.elastic.co/t/how-to-use-aggregations-with-filter/19466/2 "2014-09-01T16:07:45Z")

</div>

Can someone see this post on mailinglist? I see "currently not accepted by mailing list", but I am subribed to it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:05am UTC](https://discuss.elastic.co/t/how-to-use-aggregations-with-filter/19466/3 "2017-07-06T01:05:09Z")

</div>