How can I filter the counter less than a parameter in Kibana?

Question

I have a question similar to this: How can I filter a field greater than a counter on Kibana? https://github.com/elastic/kibana/issues/9684

On this link there is a perfect answer: You need use "{'min_doc_count': X}" on your Json Input Advanced Bucket Option. Perfect, It runs exactly like I want, except because I want the oposite, something like "max_doc_count".

For my surprise, this options doesn't existis... Some one knows what would be the "max_doc_count" equivalent of?

In SQL would be something like: GROUP BY my_field HAVING COUNT(*) < 3

Thanks.

Answer 1

The correct way of doing this in ES is to use a bucket_selector pipeline aggregation with the special _count path.

POST /_search
{
  "size": 0,
  "aggs": {
    "my_terms": {
      "terms": {
        "field": "my_field.keyword"
      },
      "aggs": {
        "max_doc_count": {
          "bucket_selector": {
            "buckets_path": {
              "count": "_count"
            },
            "script": {
              "source": "params.count < 3"
            }
          }
        }
      }
    }
  }
}

In the results, the my_terms aggregations will only contain buckets where the document count is < 3. No need to order anything or to program your application to ignore anything.