# Is it possible to filter documents based on a field in the most recent version, but still get all the documents?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-filter-documents-based-on-a-field-in-the-most-recent-version-but-still-get-all-the-documents/196845>\
**Category:** Elasticsearch\
**Created:** [August 26, 2019, 10:15pm UTC](https://discuss.elastic.co/t/is-it-possible-to-filter-documents-based-on-a-field-in-the-most-recent-version-but-still-get-all-the-documents/196845 "2019-08-26T22:15:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![btr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/btr/32/27835_2.png) [@btr](https://discuss.elastic.co/u/btr)\
**Post date:** [August 26, 2019, 10:15pm UTC](https://discuss.elastic.co/t/is-it-possible-to-filter-documents-based-on-a-field-in-the-most-recent-version-but-still-get-all-the-documents/196845/1 "2019-08-26T22:15:07Z")

</div>

I have a wildcard index (let's call it `foo-*`) that gets created once per day. So for example, I have the following indexes now that I search across:

```
foo-2019-08-23
foo-2019-08-24
foo-2019-08-25
foo-2019-08-26

```

One field in my document is a keyword field called `name` and another is a boolean field called `active`. I need to be able to search for all the documents with the same `name` but filter based on the `active` field in the **most recent document**. Is this possible?

For example, let's say I have the following documents:

```
{"@timestamp": "2019-08-23T10:00:00.000Z", "name": "foo", "active": false}
{"@timestamp": "2019-08-24T23:00:00.000Z", "name": "foo", "active": false}
{"@timestamp": "2019-08-25T14:00:00.000Z", "name": "foo", "active": true}

```

If I wanted to search for all documents with the name `foo`, but only when `foo` is currently **not** active, then in the above case my search would return nothing. However, if I wanted all the `foo` documents when `foo` **is** currently active, then in the above case my search would return all 3 documents.

Please advise. Thank you in advance!

**EDIT**

My ultimate goal is to be able to aggregate documents no matter what the current value is for `active`, then only return aggregated results for ones that should be considered `active` based on the most recent document. Perhaps a different example will explain my use case a little better.

```
{"@timestamp": "2019-08-23T10:00:00.000Z", "name": "foo", "active": false, "count": 5}
{"@timestamp": "2019-08-24T23:00:00.000Z", "name": "foo", "active": false, "count": 6}
{"@timestamp": "2019-08-25T14:00:00.000Z", "name": "foo", "active": true, "count": 7}

{"@timestamp": "2019-08-23T09:00:00.000Z", "name": "bar", "active": false, "count": 2}
{"@timestamp": "2019-08-24T22:00:00.000Z", "name": "bar", "active": true, "count": 3}
{"@timestamp": "2019-08-25T13:00:00.000Z", "name": "bar", "active": false, "count": 4}

```

Given the above two sets of documents, one for `foo` and one for `bar`, assume I did a match all search, doing a sum aggregation on the `count` field, grouping by `name`. I would end up with aggregation results like the following:

```
{"name": "foo", "count": 18}
{"name": "bar", "count": 9}

```

This is a simple query. The one I'm trying to figure out how to do is to limit the aggregated results returned based on the `active` field in the most recent document for a given `name` value. As an example, lets say I wanted to do the above, but only see results for a group who's most recent document has `active: false`. In this case, I'd want to have the following returned to me:

```
{"name": "bar", "count": 9}

```

I briefly considered using `active` as a filter, but that would mess up the results of the `count` aggregation.

To reiterate, I want to aggregate over **all** documents, grouped by a field (in this case `name`), but only return certain aggregated results based on the `active` value of the most recent document in each group.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 23, 2019, 10:15pm UTC](https://discuss.elastic.co/t/is-it-possible-to-filter-documents-based-on-a-field-in-the-most-recent-version-but-still-get-all-the-documents/196845/2 "2019-09-23T22:15:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.