Filter aggregation in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a filter aggregation that matches documents where the field "status" is "active".

Elasticsearch

{
  "aggs": {
    "active_users": {
      "filter": {
        "term": { "status": [1] }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A"deleted"

B"inactive"

C"pending"

D"active"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a wrong status value like "inactive" or "pending".

Forgetting to put quotes around the string value.

The filter aggregation uses a term query to match documents where the field status equals "active".

2fill in blank

medium

Complete the code to add a filter aggregation that matches documents where the "age" field is greater than 30.

Elasticsearch

{
  "aggs": {
    "age_filter": {
      "filter": {
        "range": { "age": { "[1]": 30 } }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Alt

Bgt

Cgte

Dlte

Attempts:

3 left

💡 Hint

Common Mistakes

Using "lt" or "lte" which filter for less than values.

Confusing "gte" with "gt".

The range filter uses "gt" to select documents where the field is greater than the given value.

3fill in blank

hard

Fix the error in the filter aggregation to correctly filter documents where "category" is "books".

Elasticsearch

{
  "aggs": {
    "books_filter": {
      "filter": {
        "term": { "category": [1] }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A"books"

Bbooks

C'books'

Dcategory

Attempts:

3 left

💡 Hint

Common Mistakes

Using unquoted strings which cause JSON errors.

Using single quotes which are invalid in JSON.

The term query value must be a string enclosed in double quotes in JSON, so "books" is correct.

4fill in blank

hard

Fill both blanks to create a filter aggregation that matches documents where "price" is between 10 and 50 inclusive.

Elasticsearch

{
  "aggs": {
    "price_range": {
      "filter": {
        "range": { "price": { [1]: 10, [2]: 50 } }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A"gte"

B"lt"

C"lte"

D"gt"

Attempts:

3 left

💡 Hint

Common Mistakes

Using "gt" or "lt" which exclude boundary values.

Mixing up the operators or using invalid keys.

Use "gte" for greater than or equal to 10 and "lte" for less than or equal to 50 to include both ends.

5fill in blank

hard

Fill all three blanks to create a filter aggregation that matches documents where "tags" contain "python" and the "rating" is greater than 4.

Elasticsearch

{
  "aggs": {
    "python_high_rating": {
      "filter": {
        "bool": {
          "must": [
            { "term": { "tags": [1] } },
            { "range": { "rating": { [2]: [3] } } }
          ]
        }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A"python"

B"gt"

C4

D"gte"

Attempts:

3 left

💡 Hint

Common Mistakes

Using unquoted strings for term values.

Using "gte" instead of "gt" if strictly greater is required.

Putting the number 4 in quotes which makes it a string.

The term filter matches documents with the tag "python". The range filter uses "gt" to select ratings greater than 4.

Practice

1. What is the main purpose of a filter aggregation in Elasticsearch?

easy

A. To delete documents matching a query

B. To sort documents by a field value

C. To update documents in the index

D. To select documents that match a specific condition

Solution

1. Step 1: Understand filter aggregation role

   A filter aggregation is used to select documents that meet a certain condition or criteria.

2. Step 2: Compare with other options

   Sorting, updating, or deleting documents are not functions of filter aggregation.

3. Final Answer:

   To select documents that match a specific condition -> Option D

4. Quick Check:

   Filter aggregation = select matching documents [OK]

Hint: Filter aggregation selects matching documents only [OK]

Common Mistakes:

• Confusing filter aggregation with sorting
• Thinking filter aggregation modifies documents
• Mixing filter aggregation with delete operations

2. Which of the following is the correct syntax to define a filter aggregation in an Elasticsearch query?

easy

A. "aggs": { "my_filter": { "filter": { "term": { "status": "active" } } } }

B. "aggs": { "my_filter": { "terms": { "field": "status" } } }

C. "aggs": { "my_filter": { "range": { "field": "age", "gte": 30 } } }

D. "aggs": { "my_filter": { "match": { "status": "active" } } }

Solution

1. Step 1: Identify filter aggregation syntax

   The filter aggregation uses the key "filter" with a query inside, like "term" for exact match.

2. Step 2: Check each option

   "aggs": { "my_filter": { "filter": { "term": { "status": "active" } } } } correctly uses "filter" with a "term" query. Options A, C, and D use other aggregation types or query types incorrectly.

3. Final Answer:

   "aggs": { "my_filter": { "filter": { "term": { "status": "active" } } } } -> Option A

4. Quick Check:

   Filter aggregation syntax = option with "filter" key [OK]

Hint: Filter aggregation always uses "filter" key inside aggs [OK]

Common Mistakes:

• Using "terms" instead of "filter" for filter aggregation
• Confusing query types inside aggregation
• Missing the "filter" key in aggregation

3. Given this Elasticsearch aggregation query snippet, what will be the count of documents in the filter aggregation named active_users?

{
  "aggs": {
    "active_users": {
      "filter": { "term": { "status": "active" } }
    }
  }
}

Assuming the index has 1000 documents, 300 of which have status set to active.

medium

A. 300

B. 1000

C. 700

D. 0

Solution

1. Step 1: Understand filter aggregation result

   The filter aggregation counts documents matching the filter condition, here "status" = "active".

2. Step 2: Apply given data

   Out of 1000 documents, 300 have status "active", so the aggregation count is 300.

3. Final Answer:

   300 -> Option A

4. Quick Check:

   Filter count = matching docs = 300 [OK]

Hint: Filter aggregation count = number of matching documents [OK]

Common Mistakes:

• Choosing total documents instead of filtered count
• Confusing filter aggregation with terms aggregation count
• Assuming zero if filter is not exact

4. Identify the error in this filter aggregation query:

{
  "aggs": {
    "filtered_data": {
      "filter": {
        "terms": {
          "status": "active"
        }
      }
    }
  }
}

medium

A. The filter aggregation must use "term" not "terms" for single value

B. The "terms" query requires an array of values, not a single string

C. The aggregation name "filtered_data" is invalid

D. The filter aggregation cannot be nested inside "aggs"

Solution

1. Step 1: Check the "terms" query usage

   The "terms" query expects an array of values, e.g., ["active"], not a single string.

2. Step 2: Validate other parts

   The aggregation name is valid, and filter aggregation can be inside "aggs". Using "term" is an alternative but not an error here.

3. Final Answer:

   The "terms" query requires an array of values, not a single string -> Option B

4. Quick Check:

   "terms" query needs array, not string [OK]

Hint: "terms" query needs array of values, not single string [OK]

Common Mistakes:

• Using string instead of array for "terms" query
• Thinking aggregation names have restrictions
• Believing filter aggregation can't be nested

5. You want to find the average price of products only in the category "electronics" using filter aggregation. Which of the following query snippets correctly combines filter aggregation with an average sub-aggregation?

hard

A. {
"query": { "term": { "category": "electronics" } },
"aggs": { "avg_price": { "avg": { "field": "price" } } }
}

B. {
"aggs": {
"avg_price": { "avg": { "field": "price" } },
"filter": { "term": { "category": "electronics" } }
}
}

C. {
"aggs": {
"electronics_filter": {
"filter": { "term": { "category": "electronics" } },
"aggs": { "avg_price": { "avg": { "field": "price" } } }
}
}
}

D. {
"aggs": {
"electronics_filter": {
"terms": { "field": "category" },
"aggs": { "avg_price": { "avg": { "field": "price" } } }
}
}
}

Solution

1. Step 1: Understand filter aggregation with sub-aggregation

   Filter aggregation uses "filter" key and can contain sub-aggregations inside "aggs".

2. Step 2: Check each option

   { "aggs": { "electronics_filter": { "filter": { "term": { "category": "electronics" } }, "aggs": { "avg_price": { "avg": { "field": "price" } } } } } } correctly nests an average aggregation inside a filter aggregation for category "electronics". { "aggs": { "avg_price": { "avg": { "field": "price" } }, "filter": { "term": { "category": "electronics" } } } } misplaces filter outside aggregation. { "query": { "term": { "category": "electronics" } }, "aggs": { "avg_price": { "avg": { "field": "price" } } } } uses query filtering, not aggregation filtering. { "aggs": { "electronics_filter": { "terms": { "field": "category" }, "aggs": { "avg_price": { "avg": { "field": "price" } } } } } } uses "terms" aggregation, not filter.

3. Final Answer:

   { "aggs": { "electronics_filter": { "filter": { "term": { "category": "electronics" } }, "aggs": { "avg_price": { "avg": { "field": "price" } } } } } } -> Option C

4. Quick Check:

   Filter aggregation with sub-aggregation = { "aggs": { "electronics_filter": { "filter": { "term": { "category": "electronics" } }, "aggs": { "avg_price": { "avg": { "field": "price" } } } } } } [OK]

Hint: Nest avg aggregation inside filter aggregation's "aggs" [OK]

Common Mistakes:

• Placing filter outside aggregation block
• Using query filter instead of filter aggregation
• Confusing terms aggregation with filter aggregation