honeymoose/OpenSearch
1
0
Fork 0
mirror of https://github.com/honeymoose/OpenSearch.git synced 2025-02-23 05:15:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Tidied up the filters agg docs and added a coming[] tag

Browse Source
This commit is contained in:
Clinton Gormley 2014-08-07 09:03:08 +02:00
parent 9d65db4dba
commit 7b0b315b71
1 changed files with 88 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

159
docs/reference/search/aggregations/bucket/filters-aggregation.asciidoc
View File

@ -1,113 +1,130 @@
[[search-aggregations-bucket-filters-aggregation]]
=== Filters
Defines a multi bucket aggregations where each bucket is associated with a filter. Each bucket will collect all
documents that match its associated filter.
coming[1.4.0]
Defines a multi bucket aggregations where each bucket is associated with a
filter. Each bucket will collect all documents that match its associated
filter.
Example:
[source,js]
--------------------------------------------------
{
"aggs" : {
"messages" : {
"filters" : {
"filters" : {
"errors" : { "query" : { "match" : { "body" : "error" } } },
"warnings" : { "query" : { "match" : { "body" : "warning" } } }
}
},
"aggs" : { "monthly" : { "histogram" : { "field" : "timestamp", "interval" : "1M" } } }
"aggs" : {
"messages" : {
"filters" : {
"filters" : {
"errors" : { "term" : { "body" : "error" }},
"warnings" : { "term" : { "body" : "warning" }}
}
},
"aggs" : {
"monthly" : {
"histogram" : {
"field" : "timestamp",
"interval" : "1M"
}
}
}
}
}
}
--------------------------------------------------
In the above example, we analyze log messages. The aggregation will build two collection (buckets) of log messages - one
for all those containing an error, and another for all those containing a warning. And for each of these buckets it will
break them down by month.
In the above example, we analyze log messages. The aggregation will build two
collection (buckets) of log messages - one for all those containing an error,
and another for all those containing a warning. And for each of these buckets
it will break them down by month.
Response:
[source,js]
--------------------------------------------------
{
...
"aggs" : {
"messages" : {
"buckets" : {
"errors" : {
"doc_count" : 34,
"monthly" : {
"buckets : [
... // the histogram monthly breakdown
]
}
},
"warnings" : {
"doc_count" : 439,
"monthly" : {
"buckets : [
... // the histogram monthly breakdown
]
}
}
...
"aggs" : {
"messages" : {
"buckets" : {
"errors" : {
"doc_count" : 34,
"monthly" : {
"buckets : [
... // the histogram monthly breakdown
]
}
},
"warnings" : {
"doc_count" : 439,
"monthly" : {
"buckets : [
... // the histogram monthly breakdown
]
}
}
}
}
}
}
}
...
--------------------------------------------------
==== Anonymous filters
The filters field can also be provided as an array of filters, as in the following request:
The filters field can also be provided as an array of filters, as in the
following request:
[source,js]
--------------------------------------------------
{
"aggs" : {
"messages" : {
"filters" : {
"filters" : [
"query" : { "match" : { "body" : "error" } },
"query" : { "match" : { "body" : "warning" } }
]
},
"aggs" : { "monthly" : { "histogram" : { "field" : "timestamp", "interval" : "1M" } } }
"aggs" : {
"messages" : {
"filters" : {
"filters" : [
{ "term" : { "body" : "error" }},
{ "term" : { "body" : "warning" }}
]
},
"aggs" : {
"monthly" : {
"histogram" : {
"field" : "timestamp",
"interval" : "1M"
}
}
}
}
}
}
--------------------------------------------------
The filtered buckets are returned in the same order as provided in the request. The response for this example would be:
The filtered buckets are returned in the same order as provided in the
request. The response for this example would be:
[source,js]
--------------------------------------------------
{
...
"aggs" : {
"messages" : {
"buckets" : [
{
"doc_count" : 34,
"monthly" : {
"buckets : [
... // the histogram monthly breakdown
]
}
},
{
"doc_count" : 439,
"monthly" : {
"buckets : [
... // the histogram monthly breakdown
]
}
}
...
"aggs" : {
"messages" : {
"buckets" : [
{
"doc_count" : 34,
"monthly" : {
"buckets : [
... // the histogram monthly breakdown
]
}
},
{
"doc_count" : 439,
"monthly" : {
"buckets : [
... // the histogram monthly breakdown
]
}
}
]
}
}
}
...
--------------------------------------------------