Multiple filters and an aggregate in elasticsearch

Question

How can I use a filter in connection with an aggregate in elasticsearch?

The official documentation gives only trivial examples for filter and for aggregations and no formal description of the query dsl - compare it e.g. with postgres documentation.

Through trying out I found following query, which is accepted by elasticsearch (no parsing errors), but ignores the given filters:

{   "filter": {     "and": [       {         "term": {           "_type": "logs"         }       },       {         "term": {           "dc": "eu-west-12"         }       },       {         "term": {           "status": "204"         }       },       {         "range": {           "@timestamp": {             "from": 1398169707,             "to": 1400761707           }         }       }     ]   },   "size": 0,   "aggs": {     "time_histo": {       "date_histogram": {         "field": "@timestamp",         "interval": "1h"       },       "aggs": {         "name": {           "percentiles": {             "field": "upstream_response_time",             "percents": [               98.0             ]           }         }       }     }   } } 

Some people suggest using query instead of filter. But the official documentation generally recommends the opposite for filtering on exact values. Another issue with query: while filters offer an and, query does not.

Can somebody point me to documentation, a blog or a book, which describe writing non-trivial queries: at least an aggregate plus multiple filters.

Answer 1

I ended up using a filter aggregation - not filtered query. So now I have 3 nested aggs elements.

I also use bool filter instead of and as recommended by @alex-brasetvik because of http://www.elasticsearch.org/blog/all-about-elasticsearch-filter-bitsets/

My final implementation:

{   "aggs": {     "filtered": {       "filter": {         "bool": {           "must": [             {               "term": {                 "_type": "logs"               }             },             {               "term": {                 "dc": "eu-west-12"               }             },             {               "term": {                 "status": "204"               }             },             {               "range": {                 "@timestamp": {                   "from": 1398176502000,                   "to": 1400768502000                 }               }             }           ]         }       },       "aggs": {         "time_histo": {           "date_histogram": {             "field": "@timestamp",             "interval": "1h"           },           "aggs": {             "name": {               "percentiles": {                 "field": "upstream_response_time",                 "percents": [                   98.0                 ]               }             }           }         }       }     }   },   "size": 0 }