Kibana : Filter doc values in only one aggreation in data table


I want to create a data table that has 2 aggregations, but the first aggregation must filter all documents that have "unbillable:true", while the second aggregation doesn't have any filter.

I thought that by adding the following json in the Advanced JSON Input would filter doc values, but it didn't work. So is it possible to have two aggregations in the same data table, but filtering doc values in only one of the two? Of course if there is another solution beyond Advanced JSON Input, I would gladly hear it.

  "bool": {
    "should": [
        "term": {
          "unbillable": true

In the following image, is the result that I would like to have:

I found a solution. I made a scripted field that creates a new field in the document.
The field takes value 1 only if unbillable=true. And when I count that field in kibana I get the desired result.
To create scripted field go to : Management->Index patterns-> your index -> Scripted field

See the following example:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.