# Return only Keys matching a pattern in Aggregations

**URL:** <https://discuss.elastic.co/t/return-only-keys-matching-a-pattern-in-aggregations/136147>\
**Category:** Elasticsearch\
**Created:** [June 15, 2018, 9:36pm UTC](https://discuss.elastic.co/t/return-only-keys-matching-a-pattern-in-aggregations/136147 "2018-06-15T21:36:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mindtech](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mindtech/32/77348_2.png) [@Mindtech](https://discuss.elastic.co/u/Mindtech)\
**Post date:** [June 15, 2018, 9:36pm UTC](https://discuss.elastic.co/t/return-only-keys-matching-a-pattern-in-aggregations/136147/1 "2018-06-15T21:36:55Z")

</div>

Hello,

is there a way to only return keys in aggregations that match a certain pattern?

I have an aggregation on sports that returns

Football =\> 100,  
Handball =\> 50,  
Hockey =\> 40,  
Racquetball =\> 30,  
Tennis =\> 20

Now I just want to return keys that contain "ball" , so in this example Tennis and Hockey would not make it into the aggregation.

I saw the bucket\_selector which I think would solve this but it can only work with numbers?

Thank you so much

---

<div class="post-metadata">

**Author:** ![klof](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/klof/32/31590_2.png) [@klof](https://discuss.elastic.co/u/klof)\
**Post date:** [June 16, 2018, 5:43am UTC](https://discuss.elastic.co/t/return-only-keys-matching-a-pattern-in-aggregations/136147/2 "2018-06-16T05:43:28Z")

</div>

Why not just query on the field sports? with wildcard or regex query?  
Then your aggregation will be applied only on the results of the query.

---

<div class="post-metadata">

**Author:** ![Mindtech](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mindtech/32/77348_2.png) [@Mindtech](https://discuss.elastic.co/u/Mindtech)\
**Post date:** [June 16, 2018, 12:00pm UTC](https://discuss.elastic.co/t/return-only-keys-matching-a-pattern-in-aggregations/136147/3 "2018-06-16T12:00:08Z")

</div>

Sorry, while this works fine for strings, the field is an array with interests, eg

['Football','Hockey','Racquetball']

so the query filter works fine of course to only get items that have at least one '_ball_' as an interest but in this case the terms aggregation would also return 'Hockey' ?

---

<div class="post-metadata">

**Author:** ![klof](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/klof/32/31590_2.png) [@klof](https://discuss.elastic.co/u/klof)\
**Post date:** [June 16, 2018, 12:21pm UTC](https://discuss.elastic.co/t/return-only-keys-matching-a-pattern-in-aggregations/136147/4 "2018-06-16T12:21:27Z")

</div>

Oh ok I get your point.  
Indeed, I think with the bucket selector this is doable, with a script that will evaluate your regex and returns a boolean.

---

<div class="post-metadata">

**Author:** ![Mindtech](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mindtech/32/77348_2.png) [@Mindtech](https://discuss.elastic.co/u/Mindtech)\
**Post date:** [June 16, 2018, 8:50pm UTC](https://discuss.elastic.co/t/return-only-keys-matching-a-pattern-in-aggregations/136147/5 "2018-06-16T20:50:07Z")

</div>

the problem I ran into with the bucket\_selector was that I got an error that the bucket\_path has a string value and is not numeric?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 14, 2018, 8:50pm UTC](https://discuss.elastic.co/t/return-only-keys-matching-a-pattern-in-aggregations/136147/6 "2018-07-14T20:50:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.