Learning Elastic Stack 6.0

Filters aggregation

With filters aggregation, you can create multiple buckets, each with its own specified filter that will cause those documents satisfying that filter to fall into the related bucket. Let's understand it with an example.

We want to create multiple buckets to understand how much of the network traffic was caused by the Chat category. At the same time, we want to understand how much of it was caused by the Skype application versus other applications in the Chat category. This can be achieved using filters aggregation as it allows us to write arbitrary filters to create buckets:

GET bigginsight/_search?size=0{  "aggs": {    "messages": {      "filters": {        "filters": {          "chat": { "match": { "category": "Chat" }},               "skype": { "match": ...