Writing aggregate with filtering

Elastic Stack Elasticsearch
1

I'm trying to write an ElasticSearch aggregate query that includes filtering where I am wanting to grab all of the tags off a all of the documents where a user id matches the one I specify.

I have this code:

{
  "size": 0,
  "aggs": {
    "tags": {
      "filter": { "term": { "account_id": 123  } },
      "terms": {
        "field": "tag_list",
        "size": 10
      }
    }
  }
}

But I get the following error:

      {
        "type": "parsing_exception",
        "reason": "Found two aggregation type definitions in [tags]: [filter] and [terms]",
        "line": 6,
        "col": 16
      }

The document mapping contains a tag_list attribute that is an array of tags.

2

Your request is malformed. You need to nest the terms aggregation inside the filter aggregation like this:

{
  "size": 0,
  "aggs": {
    "my_filter": {
      "filter": {
        "term": {
          "account_id": 43049
        }
      },
      "aggs": {
        "tags": {
          "terms": {
            "field": "tag_list",
            "size": 10
          }
        }
      }
    }
  }
}
3

Thank you!! I think this is working, but for some reason its not returning all of the collected tags across all documents, even when I remove the size: 10

4

10 is the default value of size, so removing it does not make a difference. Try setting it to 100 or even 1000.

If you have a very large number of tags, you could also consider wrapping your terms aggregation in a composite aggregation. The composite agg allows you to paginate through all the buckets.

5

Thanks @abdon!! I actually figured out my question shortly after asking. I'll look into the composite aggregation. For now, I'll set the size to 1000