How to filter subindex for aggregation in Elasticsearch?

Question

I request a wildcard index ( interactive* ) to get all documents for the two indexes interactive-foo* and interactive-bar* .

For some of my aggregates, all indexes are relevant, but for others, only interactive-foo* OR interactive-bar* . So I just want to filter these “subindexes” in aggregation.

 GET _search { "query":{ "bool": { "must": [ { "range": { "timestamp": { "gte": "2017-08-01 00:00:00", "lte": "2017-08-31 23:59:59" } } }, { "match": { "key": "SOME_KEY" } } ] } }, "size":0, "aggs": { // This one should be filtered and just count for interactive-bar* "bar_count": { "value_count": { "field": "SOME_FIELD" } }, // This one should be filtered and just count for interactive-foo* "foo_count": { "value_count": { "field": "SOME_FIELD" } } } } 

Answer 1

You can use filter aggregation as follows:

 { "query": { "bool": { "must": [ { "range": { "timestamp": { "gte": "2017-08-01 00:00:00", "lte": "2017-08-31 23:59:59" } } }, { "match": { "key": "SOME_KEY" } } ] } }, "size": 0, "aggs": { "bar_count": { "filter": { "indices": { "indices": ["interactive-bar-*"] } }, "aggs": { "bar_count": { "value_count": { "field": "SOME_FIELD" } } } }, "foo_count": { "filter": { "indices": { "indices": ["interactive-foo-*"] } }, "aggs": { "foo_count": { "value_count": { "field": "SOME_FIELD" } } } } } } 

Note that the indices query is deprecated in ES 5.0. Instead, you should use the terms query in the _index field and a list of all the indexes that you want to include in your aggregation, for example:

  "size": 0, "aggs": { "bar_count": { "filter": { "terms": { "_index": ["interactive-foo-2017.08.14", "interactive-foo-2017.08.15"] } }, "aggs": { "bar_count": { "value_count": { "field": "SOME_FIELD" } } } }, "foo_count": { "filter": { "terms": { "_index": ["interactive-bar-2017.08.14", "interactive-bar-2017.08.15"] } }, "aggs": { "foo_count": { "value_count": { "field": "SOME_FIELD" } } } } } }