# Q on search aggregation

**URL:** <https://discuss.elastic.co/t/q-on-search-aggregation/63117>\
**Category:** Elasticsearch\
**Created:** [October 15, 2016, 11:21pm UTC](https://discuss.elastic.co/t/q-on-search-aggregation/63117 "2016-10-15T23:21:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [October 15, 2016, 11:21pm UTC](https://discuss.elastic.co/t/q-on-search-aggregation/63117/1 "2016-10-15T23:21:29Z")

</div>

Newbie in querying ES, I'm wondering if a search, which only returns aggregation data, something like this:

```
{
  "query": {
    "filtered": {
      "query": {
        "query_string": {
          "query": "<some query>"
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "@timestamp": {
                  "gte": <epoch low>,
                  "lte": <epoch high>,
                  "format": "epoch_millis"
                }
              }
            }
          ],
          "must_not": []
        }
      }
    }
  },
  "size": 0,
  "aggs": {
    "data": {
      "terms": {
        "field": "<bucket field>",
        "size": 5,
        "order": {
          "_count": "desc"
        }
      }
    }
  }
}

```

could be constrained further to only return data if bucket counts are above a threshold or in a range and if so how?

TIA

```
# curl -s -XGET 'http://127.0.0.1:9200/<index>/<type>/_search' -d@es.queries/uniq.boxes | jq .aggregations.data.buckets 
[
  {
    "key": "200000724940",
    "doc_count": 1191
  },
  {
    "key": "200001272797",
    "doc_count": 1189
  },
  {
    "key": "200001192179",
    "doc_count": 106
  },
  {
    "key": "9025586118600015778",
    "doc_count": 15
  },
  {
    "key": "200001169953",
    "doc_count": 10
  }
]
```

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [October 15, 2016, 11:46pm UTC](https://discuss.elastic.co/t/q-on-search-aggregation/63117/2 "2016-10-15T23:46:20Z")

</div>

Does the [bucket selector aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html)  
do the job for you?

---

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [October 16, 2016, 12:08am UTC](https://discuss.elastic.co/t/q-on-search-aggregation/63117/3 "2016-10-16T00:08:35Z")

</div>

Thanks, looks like it might, will try it....

---

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [October 16, 2016, 12:57am UTC](https://discuss.elastic.co/t/q-on-search-aggregation/63117/4 "2016-10-16T00:57:12Z")

</div>

Yeap, thanks, works when enabling inline script+search with this eg.

```
  "aggs": {
    "data": {
      "terms": {
        "field": "<bucket field>",
        "size": 5,
        "order": {
          "_count": "desc"
        }
      },
      "aggs": {
        "data_bucket_filter": {
          "bucket_selector": {
            "buckets_path": { "cnt": "_count" },
            "script": "cnt > 500"
          }
        }
      }
    }

```

makes it now return:

```
# curl -s -XGET 'http://127.0.0.1:9200/<index>/<type>/_search' -d@es.queries/uniq.boxes | jq .aggregations.data.buckets 
[
  {
    "key": "200000724940",
    "doc_count": 1191
  },
  {
    "key": "200001272797",
    "doc_count": 1189
  }
]
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:11pm UTC](https://discuss.elastic.co/t/q-on-search-aggregation/63117/5 "2017-07-05T22:11:58Z")

</div>