# Inconsistent behaviour when using include inside filter aggregation

**URL:** <https://discuss.elastic.co/t/inconsistent-behaviour-when-using-include-inside-filter-aggregation/67479>\
**Category:** Elasticsearch\
**Created:** [November 29, 2016, 12:25pm UTC](https://discuss.elastic.co/t/inconsistent-behaviour-when-using-include-inside-filter-aggregation/67479 "2016-11-29T12:25:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mpritsch](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mpritsch](https://discuss.elastic.co/u/mpritsch)\
**Post date:** [November 29, 2016, 12:25pm UTC](https://discuss.elastic.co/t/inconsistent-behaviour-when-using-include-inside-filter-aggregation/67479/1 "2016-11-29T12:25:20Z")

</div>

We noticed some inconsistencies when using filter aggregations in combination with includes/excludes.  
Specifying an include term which results in a doc\_count of 0 is only returned as bucket if the overall doc\_count is \> 0.

Below are two documents of type 'book' which have the fields title, author and narrator. Both documents have the same author.

```
PUT filter
{
  "settings": {
    "number_of_shards": 1
  },
  "mappings": {
    "book": {
      "properties": {
        "title": {
          "type": "keyword"
        },
        "author": {
          "type": "keyword"
        },
        "narrator": {
          "type": "keyword"
        }
      }
    }
  }
}

```

Documents:

```
PUT filter/book/1
{
    "title" : "Mango",
    "author" : "Winton",
    "narrator" : "Moritz"
}

PUT filter/book/2
{
    "title" : "Banana",
    "author" : "Winton",
    "narrator" : "Max"
}

```

The following is an aggregation on the field "title" specifying an include of "Mango" setting "min\_doc\_count: 0" to include buckets with no matching documents.  
The query will match book 2.  
The subaggregation on field title is performed using book 2 only.

```
POST filter/book/_search
{
  "size": 0,
  "aggregations": {
    "titleIncluded": {
      "filter": {
        "bool": {
          "must": [
            {
              "terms": {
                "title": [
                  "Banana"
                ]
              }
            },
            {
              "bool": {
                "must_not": [
                  {
                    "terms": {
                      "narrator": [
                        "Moritz"
                      ]
                    }
                  }
                ]
              }
            }
          ]
        }
      },
      "aggregations": {
        "titleSubAggregation": {
          "terms": {
            "field": "title",
            "min_doc_count": 0,
            "include": [
              "Mango"
            ]
          }
        }
      }
    }
  }
} 

```

The subaggregation results in a bucket for "Mango" with doc\_count being 0.

Result:

```
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "titleIncluded": {
      "doc_count": 1,
      "titleSubAggregation": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": [
          {
            "key": "Mango",
            "doc_count": 0
          }
        ]
      }
    }
  }
}

```

The only thing we changed below is the query which does not match any of the two documents.

```
POST filter/book/_search
{
  "size": 0,
  "aggregations": {
    "titleIncluded": {
      "filter": {
        "bool": {
          "must": [
            {
              "terms": {
                "narrator": [
                  "Max"
                ]
              }
            },
            {
              "bool": {
                "must_not": [
                  {
                    "terms": {
                      "title": [
                        "Banana"
                      ]
                    }
                  }
                ]
              }
            }
          ]
        }
      },
      "aggregations": {
        "titleSubAggregation": {
          "terms": {
            "field": "title",
            "min_doc_count": 0,
            "include": [
              "Mango"
            ]
          }
        }
      }
    }
  }
} 

```

As you can see in the result there is no bucket at all.

Result:

```
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "titleIncluded": {
      "doc_count": 0,
      "titleSubAggregation": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": []
      }
    }
  }
}

```

It seems that in the second case no aggregation is performed because the query results in 0 documents.  
Is this intended or is it a bug? For me it seems like an inconsistent behaviour when using include inside filter aggregations.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2016, 12:25pm UTC](https://discuss.elastic.co/t/inconsistent-behaviour-when-using-include-inside-filter-aggregation/67479/2 "2016-12-27T12:25:27Z")

</div>

Closed on December 27, 2016, 12:25pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.