# I want to except results on a specific date from elastic aggregation

**URL:** https://discuss.elastic.co/t/i-want-to-except-results-on-a-specific-date-from-elastic-aggregation/262741
**Category:** Elasticsearch
**Created:** [January 31, 2021, 7:58am UTC](https://discuss.elastic.co/t/i-want-to-except-results-on-a-specific-date-from-elastic-aggregation/262741 "2021-01-31T07:58:42Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![e997cd7e8d9915436150](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e997cd7e8d9915436150/32/40255_2.png) [@e997cd7e8d9915436150](https://discuss.elastic.co/u/e997cd7e8d9915436150)
#### Post date: [January 31, 2021, 7:58am UTC](https://discuss.elastic.co/t/i-want-to-except-results-on-a-specific-date-from-elastic-aggregation/262741/1 "2021-01-31T07:58:42Z")

</div>

This is my query that returns results on 19th Oct.

```
GET apachelog/_search
{
  "size": 0, 
  "aggs": {
    "NAME": {
      "terms": {
        "field": "ext.keyword",
        "size": 10
      }
    }
  },
  "query": {
    "range": {
      "@timestamp": {
        "time_zone": "Asia/Seoul",
        "gte": "2015-10-19",
        "lt": "2015-10-20"
      }
    }
  }  
}

```

Below are the results.

```
  "aggregations" : {
    "NAME" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "php",
          "doc_count" : 36797
        },
        {
          "key" : "png",
          "doc_count" : 18202
        }
      ]
    }
  }

```

This is second query that returns results on 18th Oct.

```
GET apachelog/_search
{
  "size": 0, 
  "aggs": {
    "NAME": {
      "terms": {
        "field": "ext.keyword",
        "size": 10
      }
    }
  },
  "query": {
    "range": {
      "@timestamp": {
        "time_zone": "Asia/Seoul",
        "gte": "2015-10-18",
        "lt": "2015-10-19"
      }
    }
  }  
}

```

Below are the second results.

```
  "aggregations" : {
    "NAME" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "php",
          "doc_count" : 10885
        }
      ]
    }
  }

```

And i want to except results on 18th Oct from results on 19th Oct. Below is the result i want.

```
  "aggregations" : {
    "NAME" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "png",
          "doc_count" : 18202
        }
      ]
    }
  }

```

Can i create query behaves like sql query below in elasticsearch?

```
select distinct(ext)
from apachelog
where @timestamp = '2015-10-19'

minus

select distinct(ext)
from apachelog
where @timestamp = '2015-10-18'

```

I'm trying to write a MINUS query use the bool query with must and must\_not. This is my third query.

```
GET apachelog/_search
{
  "size": 0, 
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "time_zone": "Asia/Seoul",
              "gte": "2015-10-19",
              "lt": "2015-10-20"
            }
          }
        }
      ],
      "must_not": [
        {
          "range": {
            "@timestamp": {
              "time_zone": "Asia/Seoul",
              "gte": "2015-10-18",
              "lt": "2015-10-19"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "NAME": {
      "terms": {
        "field": "ext.keyword",
        "size": 10
      }
    }
  }
}

```

But can't returns the result i want.

```
  "aggregations" : {
    "NAME" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "php",
          "doc_count" : 36797
        },
        {
          "key" : "png",
          "doc_count" : 18202
        }
      ]
    }
  }

```

Anyone could show me the way? Thanks in advance:)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 28, 2021, 7:59am UTC](https://discuss.elastic.co/t/i-want-to-except-results-on-a-specific-date-from-elastic-aggregation/262741/2 "2021-02-28T07:59:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.