Filter aggregation in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of a simple filter aggregation

What is the output of this Elasticsearch aggregation query when run on an index with documents having a field status with values active and inactive?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "active_users": {
      "filter": {
        "term": { "status": "active" }
      }
    }
  }
}

A {"aggregations":{"active_users":{"doc_count":0}}}

B {"aggregations":{"active_users":{"doc_count":10}}}

C {"aggregations":{"active_users":{"doc_count":5}}}

D {"aggregations":{"active_users":{"doc_count":null}}}

💡 Hint

The filter aggregation counts documents matching the filter condition.

The filter aggregation returns the count of documents matching the filter. Here, it counts documents where status is 'active'.

🧠 Conceptual

intermediate

Purpose of filter aggregation in Elasticsearch

What is the main purpose of using a filter aggregation in Elasticsearch?

A To sort documents by a field value in descending order.

B To count documents matching a specific query condition without affecting other aggregations.

C To update documents matching a filter condition.

D To delete documents that do not match the filter.

💡 Hint

Filter aggregation isolates documents matching a condition for aggregation.

Filter aggregation lets you count or aggregate only documents matching a filter, without changing the overall query results.

🔧 Debug

advanced

Identify the error in this filter aggregation query

This filter aggregation query is intended to count documents where age is greater than 30. What error will Elasticsearch return?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "older_than_30": {
      "filter": {
        "range": {
          "age": { "gt": 30 }
        }
      }
    }
  }
}

A No error, returns count of documents with age > 30.

B QueryParsingException: Unknown key for a START_OBJECT in [range].

C SyntaxError: Missing colon after 'range'.

D TypeError: 'gt' is not a valid operator.

💡 Hint

Check the syntax of the range filter.

The query uses a valid range filter with 'gt' operator inside the filter aggregation, so it runs without error.

❓ Predict Output

advanced

Output of nested filter aggregations

Given this aggregation query, what is the value of doc_count for active_and_premium?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "active_users": {
      "filter": { "term": { "status": "active" } },
      "aggs": {
        "active_and_premium": {
          "filter": { "term": { "subscription": "premium" } }
        }
      }
    }
  }
}

A 3

B 5

C 8

D 0

💡 Hint

The inner filter counts documents that are both active and premium.

The outer filter selects active users (5 docs), the inner filter counts how many of those have premium subscription (3 docs).

📝 Syntax

expert

Which option causes a syntax error in filter aggregation?

Which of these filter aggregation snippets will cause a syntax error when run in Elasticsearch?

A { "filter": { "term": { "status": "active" } } }

B { "filter": { "terms": { "status": ["active", "pending"] } } }

C { "filter": { "range": { "age": { "gte": 18 } } } }

D { "filter": { "term": { "status" "active" } } }

💡 Hint

Look for missing punctuation in JSON syntax.

Option D is missing a colon between "status" and "active", causing a JSON syntax error.