This version of the OpenSearch documentation is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.

Filters aggregations

A filters aggregation is the same as the filter aggregation, except that it lets you use multiple filter aggregations. While the filter aggregation results in a single bucket, the filters aggregation returns multiple buckets, one for each of the defined filters.

To create a bucket for all the documents that didn’t match the any of the filter queries, set the other_bucket property to true:

  1. GET opensearch_dashboards_sample_data_logs/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.     "200_os": {
  6.       "filters": {
  7.         "other_bucket": true,
  8.         "filters": [
  9.           {
  10.             "term": {
  11.               "response.keyword": "200"
  12.             }
  13.           },
  14.           {
  15.             "term": {
  16.               "machine.os.keyword": "osx"
  17.             }
  18.           }
  19.         ]
  20.       },
  21.       "aggs": {
  22.         "avg_amount": {
  23.           "avg": {
  24.             "field": "bytes"
  25.           }
  26.         }
  27.       }
  28.     }
  29.   }
  30. }

copy

Example response

  1. ...
  2. "aggregations" : {
  3.   "200_os" : {
  4.     "buckets" : [
  5.       {
  6.         "doc_count" : 12832,
  7.         "avg_amount" : {
  8.           "value" : 5897.852711970075
  9.         }
  10.       },
  11.       {
  12.         "doc_count" : 2825,
  13.         "avg_amount" : {
  14.           "value" : 5620.347256637168
  15.         }
  16.       },
  17.       {
  18.         "doc_count" : 1017,
  19.         "avg_amount" : {
  20.           "value" : 3247.0963618485744
  21.         }
  22.       }
  23.     ]
  24.   }
  25.  }
  26. }