Filter aggregation in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a filter aggregation in Elasticsearch?

A filter aggregation lets you count or analyze documents that match a specific filter condition, like counting only documents with a certain field value.

beginner

How do you define a filter aggregation in an Elasticsearch query?

You define it by specifying a filter with a query inside the aggregation, like "filter": { "term": { "status": "active" } }.

intermediate

Can filter aggregation be combined with other aggregations?

Yes! You can nest other aggregations inside a filter aggregation to analyze only the filtered documents further.

intermediate

What is the difference between filter aggregation and filters aggregation?

Filter aggregation uses one filter to select documents. Filters aggregation lets you define multiple filters and get results for each filter separately.

beginner

Example: What does this filter aggregation do?

{
  "aggs": {
    "active_users": {
      "filter": { "term": { "status": "active" } }
    }
  }
}

It counts how many documents have the field status set to active. The result is the number of active users.

What does a filter aggregation do in Elasticsearch?

A Deletes documents matching a filter

B Counts documents matching a filter

C Updates documents matching a filter

D Sorts documents by a field

Filter aggregation counts or analyzes documents that match a specific filter condition.

Which key is used to specify the filter in a filter aggregation?

A "filter"

B "query"

C "match"

D "term"

The "filter" key defines the filter condition inside a filter aggregation.

Can you nest other aggregations inside a filter aggregation?

A Yes

B No

C Only in filters aggregation

D Only with terms aggregation

You can nest other aggregations inside a filter aggregation to analyze filtered documents further.

What is the main difference between filter and filters aggregations?

A Filter is faster than filters

B Filter sorts documents; filters counts documents

C Filter updates documents; filters deletes documents

D Filter uses one filter; filters uses multiple filters

Filter aggregation applies one filter; filters aggregation applies multiple filters separately.

In this filter aggregation, what does it count?

{
  "filter": { "term": { "status": "active" } }
}

A All documents

B Documents with status inactive

C Documents with status active

D Documents without status field

It counts documents where the field "status" equals "active".

Explain how filter aggregation works in Elasticsearch and give a simple example.

Think about how you count only certain documents using a filter.

Describe the difference between filter aggregation and filters aggregation.

One uses one filter, the other uses many filters at once.