# Unexpected behavior from nested -\> filter -\> nested aggregation

**URL:** <https://discuss.elastic.co/t/unexpected-behavior-from-nested-filter-nested-aggregation/15328>\
**Category:** Elasticsearch\
**Created:** [January 20, 2014, 8:55pm UTC](https://discuss.elastic.co/t/unexpected-behavior-from-nested-filter-nested-aggregation/15328 "2014-01-20T20:55:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Freeman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_freeman/32/1756_2.png) [@John\_Freeman](https://discuss.elastic.co/u/John_Freeman)\
**Post date:** [January 20, 2014, 8:55pm UTC](https://discuss.elastic.co/t/unexpected-behavior-from-nested-filter-nested-aggregation/15328/1 "2014-01-20T20:55:54Z")

</div>

First, let me say I'm very excited about the new aggregations. Great work!

I've got a type with two layers of nesting:

script:  
calls: [  
name: string  
params: [  
name: string  
value: string  
]  
]

I want to run an aggregation over the parameter values for calls to a  
specific function. Here's the skeleton of what I tried:

'aggs': {'b': {  
'nested': {'path': 'calls'},  
'aggs': {'c': {  
'filter': {'term': {'calls.name': 'particular\_func'}},  
'aggs': {'d': {  
'nested': {'path': 'calls.params'},  
'aggs': ...

The structure is three aggregations: a nested wrapping a filter wrapping a  
nested. Checking the doc counts on these, I see that the outer two work as  
expected: the doc count for the outer nested is the number of nested  
"calls" documents, the doc count for the filter is the number of those  
nested "calls" docs that pass the filter. But it appears that the inner  
nested resets the buckets: it returns the number of inner nested "params"  
documents across all "calls" docs, regardless of the filter.

Is there a way to do what I want?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/83666871-22f3-4989-9b76-be822d3cf19c%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/83666871-22f3-4989-9b76-be822d3cf19c%40googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![John\_Freeman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_freeman/32/1756_2.png) [@John\_Freeman](https://discuss.elastic.co/u/John_Freeman)\
**Post date:** [January 21, 2014, 8:15pm UTC](https://discuss.elastic.co/t/unexpected-behavior-from-nested-filter-nested-aggregation/15328/2 "2014-01-21T20:15:11Z")

</div>

Bumping because I posted this on the weekend to few views. Should I file a  
bug report?

On Monday, January 20, 2014 3:55:54 PM UTC-5, John Freeman wrote:

> First, let me say I'm very excited about the new aggregations. Great work!
> 
> I've got a type with two layers of nesting:
> 
> script:  
> calls: [  
> name: string  
> params: [  
> name: string  
> value: string  
> ]  
> ]
> 
> I want to run an aggregation over the parameter values for calls to a  
> specific function. Here's the skeleton of what I tried:
> 
> 'aggs': {'b': {  
> 'nested': {'path': 'calls'},  
> 'aggs': {'c': {  
> 'filter': {'term': {'calls.name': 'particular\_func'}},  
> 'aggs': {'d': {  
> 'nested': {'path': 'calls.params'},  
> 'aggs': ...
> 
> The structure is three aggregations: a nested wrapping a filter wrapping a  
> nested. Checking the doc counts on these, I see that the outer two work as  
> expected: the doc count for the outer nested is the number of nested  
> "calls" documents, the doc count for the filter is the number of those  
> nested "calls" docs that pass the filter. But it appears that the inner  
> nested resets the buckets: it returns the number of inner nested "params"  
> documents across all "calls" docs, regardless of the filter.
> 
> Is there a way to do what I want?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/1be3993e-2df0-4fb5-bbc7-573c3cb59c3d%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1be3993e-2df0-4fb5-bbc7-573c3cb59c3d%40googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![Michael\_Sander](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_sander/32/838_2.png) [@Michael\_Sander](https://discuss.elastic.co/u/Michael_Sander)\
**Post date:** [June 3, 2014, 1:31pm UTC](https://discuss.elastic.co/t/unexpected-behavior-from-nested-filter-nested-aggregation/15328/3 "2014-06-03T13:31:19Z")

</div>

I'm jumping into the world of nested filter aggregations. Did you ever  
figure this out?

On Tuesday, January 21, 2014 3:15:11 PM UTC-5, John Freeman wrote:

> Bumping because I posted this on the weekend to few views. Should I file a  
> bug report?
> 
> On Monday, January 20, 2014 3:55:54 PM UTC-5, John Freeman wrote:
> 
> > First, let me say I'm very excited about the new aggregations. Great work!
> > 
> > I've got a type with two layers of nesting:
> > 
> > script:  
> > calls: [  
> > name: string  
> > params: [  
> > name: string  
> > value: string  
> > ]  
> > ]
> > 
> > I want to run an aggregation over the parameter values for calls to a  
> > specific function. Here's the skeleton of what I tried:
> > 
> > 'aggs': {'b': {  
> > 'nested': {'path': 'calls'},  
> > 'aggs': {'c': {  
> > 'filter': {'term': {'calls.name': 'particular\_func'}},  
> > 'aggs': {'d': {  
> > 'nested': {'path': 'calls.params'},  
> > 'aggs': ...
> > 
> > The structure is three aggregations: a nested wrapping a filter wrapping  
> > a nested. Checking the doc counts on these, I see that the outer two work  
> > as expected: the doc count for the outer nested is the number of nested  
> > "calls" documents, the doc count for the filter is the number of those  
> > nested "calls" docs that pass the filter. But it appears that the inner  
> > nested resets the buckets: it returns the number of inner nested "params"  
> > documents across all "calls" docs, regardless of the filter.
> > 
> > Is there a way to do what I want?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/50159e46-17b9-4ad3-9911-20cbcfe7eae4%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/50159e46-17b9-4ad3-9911-20cbcfe7eae4%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![Zennet\_Wheatcroft](https://avatars.discourse-cdn.com/v4/letter/z/8491ac/32.png) [@Zennet\_Wheatcroft](https://discuss.elastic.co/u/Zennet_Wheatcroft)\
**Post date:** [October 24, 2014, 10:31pm UTC](https://discuss.elastic.co/t/unexpected-behavior-from-nested-filter-nested-aggregation/15328/4 "2014-10-24T22:31:11Z")

</div>

I'm also running into this it is not what I expected. I tried parent/child  
and got the same behavior. I expect the filtering to narrow down the  
results with each filter. I filter on a child (or nested) that has  
property=p then go back to aggregate on the parent and I get all the  
results again as if the filter is not applied.

I can include sample data, mapping, and queries if someone wants to comment.

I'm trying to do clickstream analysis on session events and user actions.  
The data models I am trying are where the session is the parent event with  
user actions as the child (or nested) events. I've tried several different  
models and have not found one that works well.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/bbc238d6-9f60-4ede-b311-9d522f930120%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/bbc238d6-9f60-4ede-b311-9d522f930120%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![Zennet\_Wheatcroft](https://avatars.discourse-cdn.com/v4/letter/z/8491ac/32.png) [@Zennet\_Wheatcroft](https://discuss.elastic.co/u/Zennet_Wheatcroft)\
**Post date:** [October 24, 2014, 11:27pm UTC](https://discuss.elastic.co/t/unexpected-behavior-from-nested-filter-nested-aggregation/15328/5 "2014-10-24T23:27:17Z")

</div>

"Lastly, it is not possible to “cross reference” between nested documents.  
One nested doc cannot “see” another nested doc’s properties. For example,  
you are not able to filter on “A.name” but facet on “B.age”. You can get  
around this by using `include_in_root`, which effectively copies the nested  
docs into the root, but this get’s you back to the problems of inner  
objects."

> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.

Perhaps this is our answer?

On Friday, October 24, 2014 3:31:11 PM UTC-7, Zennet Wheatcroft wrote:

> I'm also running into this it is not what I expected. I tried parent/child  
> and got the same behavior. I expect the filtering to narrow down the  
> results with each filter. I filter on a child (or nested) that has  
> property=p then go back to aggregate on the parent and I get all the  
> results again as if the filter is not applied.
> 
> I can include sample data, mapping, and queries if someone wants to  
> comment.
> 
> I'm trying to do clickstream analysis on session events and user actions.  
> The data models I am trying are where the session is the parent event with  
> user actions as the child (or nested) events. I've tried several different  
> models and have not found one that works well.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/24b79787-aa22-4c15-8df1-831149d3f621%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/24b79787-aa22-4c15-8df1-831149d3f621%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:53am UTC](https://discuss.elastic.co/t/unexpected-behavior-from-nested-filter-nested-aggregation/15328/6 "2017-07-06T00:53:56Z")

</div>