Expected [START_OBJECT] under [filter]

Question

I want to put double filter in aggs. such like this.

"aggs": {
  "download1" : {
        "filter" : [
            { "term": { "IPV4_DST_ADDR":"192.168.0.159"}},
            { "range": { "LAST_SWITCHED": { "gte": "now-5m" } }}
        ],
        "aggs" : {
            "downlod_bytes" : { "sum" : { "field" : "IN_BYTES" } }
        }
    }
}

but it show me an error:

"error": {
"root_cause": [
  {
    "type": "parsing_exception",
    "reason": "Expected [START_OBJECT] under [filter], but got a [START_ARRAY] in [download1]",
    "line": 33,
    "col": 24
  }
]}

How can I do, thank you in advance!

Answer 1

You need to combine both queries with a bool/filter

{
  "aggs": {
    "download1": {
      "filter": {
        "bool": {
          "filter": [
            {
              "term": {
                "IPV4_DST_ADDR": "192.168.0.159"
              }
            },
            {
              "range": {
                "LAST_SWITCHED": {
                  "gte": "now-5m"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "downlod_bytes": {
          "sum": {
            "field": "IN_BYTES"
          }
        }
      }
    }
  }
}