# Using field results from main filter as input for 'has\_child' filter (opening github issue?) **URL:** \ **Category:** Elasticsearch\ **Created:** [April 8, 2014, 8:20am UTC](https://discuss.elastic.co/t/using-field-results-from-main-filter-as-input-for-has-child-filter-opening-github-issue/16866 "2014-04-08T08:20:09Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Sven\_Beauprez](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@Sven\_Beauprez](https://discuss.elastic.co/u/Sven_Beauprez)\ **Post date:** [April 8, 2014, 8:20am UTC](https://discuss.elastic.co/t/using-field-results-from-main-filter-as-input-for-has-child-filter-opening-github-issue/16866/1 "2014-04-08T08:20:09Z")
Hi, I have followin use case for which I can't find an immediate solution right now. Use case: I have a parent child relationship where parent represent a device and child a module (eg. sensor) on a device. One device can have many modules of a certain type, eg. 'motion', 'temperature',.... Parents are quite static, but the module sends monitoring data on a regular basis to elasticsearch. I need to find the modules (module types) that are not responsive, ie. modules that did not send monitoring data between now and now - t. What I have: With the query below, I can find devices where ALL of the modules are unresponsive, but as soon as 1 module is responsive, even if the others are unresponsive, the device is said to be responsive. What I need: I need to find the devices that have at least 1 module that is unresponsive. Possible solution: Aggregate on module types, then for each module type execute filter as shown below AND give that module type to the has\_parent -\> has\_child filter as a 'and' construct with the range filter. Is this possible as is or is there another way to solve this? Do I need to create an issue to add this? regards, Sven POST /devices-v1/module/\_search?pretty=true { "size": 0, "query": { "filtered": { "query": { "match\_all": {} } } }, "aggs": { "unresponsive": { "filter": { "and": [ { "range": { "\_timestamp": { "lt": "now-25m" } } }, { "not": { "has\_parent": { "type": "device", "filter": { "has\_child": { "type": "module", "filter": { "range": { "\_timestamp": { "gte": "now-25m" } } } } } } } } ] }, "aggs": { "modules": { "terms": { "script": "doc['\_parent'].value + '|' + doc['mod\_id'].value ", "size": 1000000000, "order": { "\_term": "asc" } } } } } } } -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/3e3f1074-c283-4a86-acfa-9d443bc5db02%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3e3f1074-c283-4a86-acfa-9d443bc5db02%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Binh\_Ly\_2](https://avatars.discourse-cdn.com/v4/letter/b/d07c76/32.png) [@Binh\_Ly\_2](https://discuss.elastic.co/u/Binh_Ly_2)\ **Post date:** [April 10, 2014, 1:50pm UTC](https://discuss.elastic.co/t/using-field-results-from-main-filter-as-input-for-has-child-filter-opening-github-issue/16866/2 "2014-04-10T13:50:57Z")
I'd like to give this a try. Can you please post a recreation (maybe gist) of a bunch of sample parent and child documents and how you want the results returned exactly? Thanks. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/d2fcfa9e-83a6-4e34-90d6-656f927c7f39%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d2fcfa9e-83a6-4e34-90d6-656f927c7f39%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Sven\_Beauprez](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@Sven\_Beauprez](https://discuss.elastic.co/u/Sven_Beauprez)\ **Post date:** [April 11, 2014, 1:01pm UTC](https://discuss.elastic.co/t/using-field-results-from-main-filter-as-input-for-has-child-filter-opening-github-issue/16866/3 "2014-04-11T13:01:17Z")
Hi, Thanks for looking at this! Here is the gist: [gist:10466363 · GitHub](https://gist.github.com/sbeaupre/10466363) How to test: 1. create schema (first 2 items in gist) 2. create devices (the PUT commando's on the devices/device) 3. create module events (the PUT commando's on the devices/module) 4.a execute the search --\> there are no unresponsive devices no 4.b wait one minute (or adapt the search) --\> all devices are unresponsive now 4.c choose exactly one of the previous executed module events and execute it again; remember the parent device of the module 4.d execute the search again --\> the parent device is not listed again, while the other module has not send an event to ES search, meaning it is unresponsive within the time constraints from the search The question now is how to still get the device in the list of unresponsive devices. Only when all the modules are responsive it must not be shown in the list. thnx! regards, Sven On Thursday, April 10, 2014 3:50:57 PM UTC+2, Binh Ly wrote: > I'd like to give this a try. Can you please post a recreation (maybe gist) > of a bunch of sample parent and child documents and how you want the > results returned exactly? Thanks. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/4bb0f564-f7d8-4934-98d7-6a7c6265ac50%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4bb0f564-f7d8-4934-98d7-6a7c6265ac50%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Sven\_Beauprez](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@Sven\_Beauprez](https://discuss.elastic.co/u/Sven_Beauprez)\ **Post date:** [April 17, 2014, 2:10pm UTC](https://discuss.elastic.co/t/using-field-results-from-main-filter-as-input-for-has-child-filter-opening-github-issue/16866/4 "2014-04-17T14:10:20Z")
Hi Binh Ly, Any chance you could have a look at this? There is a post about scripting & parent/child relationships that might be useful: [https://groups.google.com/d/topic/elasticsearch/cZaK0R-UmHw/discussion](https://groups.google.com/d/topic/elasticsearch/cZaK0R-UmHw/discussion) but as far as I know that is not possible at the moment Thnx! regards, Sven On Friday, April 11, 2014 3:01:17 PM UTC+2, Sven Beauprez wrote: > Hi, > > Thanks for looking at this! Here is the gist: > [gist:10466363 · GitHub](https://gist.github.com/sbeaupre/10466363) > > How to test: > > 1. create schema (first 2 items in gist) > 2. create devices (the PUT commando's on the devices/device) > 3. create module events (the PUT commando's on the devices/module) > 4.a execute the search > --\> there are no unresponsive devices no > 4.b wait one minute (or adapt the search) > --\> all devices are unresponsive now > 4.c choose exactly one of the previous executed module events and execute > it again; remember the parent device of the module > 4.d execute the search again > --\> the parent device is not listed again, while the other module has > not send an event to ES search, meaning it is unresponsive within the time > constraints from the search > > The question now is how to still get the device in the list of > unresponsive devices. Only when all the modules are responsive it must not > be shown in the list. > > thnx! > > regards, > > Sven > > On Thursday, April 10, 2014 3:50:57 PM UTC+2, Binh Ly wrote: > > > I'd like to give this a try. Can you please post a recreation (maybe > > gist) of a bunch of sample parent and child documents and how you want the > > results returned exactly? Thanks. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/24a3c952-c280-4294-92fc-17f69241ae29%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/24a3c952-c280-4294-92fc-17f69241ae29%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:35am UTC](https://discuss.elastic.co/t/using-field-results-from-main-filter-as-input-for-has-child-filter-opening-github-issue/16866/5 "2017-07-06T01:35:15Z")
Closed on July 6, 2017, 1:35am UTC