Learning Elastic Stack 6.0

Filter aggregation

Why one would use filter aggregation? Filter aggregation allows us to create a single bucket using any arbitrary filter and computes the metrics within that bucket. 

For example, if we wanted to create a bucket of all records for the Chat category, we could use a term filter. We want to create a bucket of all records that have category = Chat.

POST /bigginsight/_search?size=0{  "aggs": {    "chat": {      "filter": {        "term": {          "category": "Chat"        }      }    }  }}

The response should look like the following:

{  "took": 4,  ...,  "hits": {    "total": 242836,    "max_score": 0,    "hits": []  },  "aggregations": {    "chat": {      "doc_count": 52277    }  }}

As you can see, the aggregations element contains just one item corresponding to the category Chat. It has ...