Filter aggregation in Elasticsearch - Step-by-Step Execution

Concept Flow - Filter aggregation

Start Query

↓

Apply Filter Condition

↓

Select Documents Matching Filter

↓

Perform Aggregations on Filtered Docs

↓

Return Aggregation Results

The filter aggregation applies a filter to select documents, then runs aggregations only on those filtered documents.

Execution Sample

Elasticsearch

{
  "aggs": {
    "filtered_sales": {
      "filter": { "term": { "status": "sold" } },
      "aggs": { "total_price": { "sum": { "field": "price" } } }
    }
  }
}

This query filters documents where status is 'sold' and sums the price field for those documents.

Execution Table

Step	Action	Filter Condition	Documents Selected	Aggregation Performed	Result
1	Start query	N/A	All documents	N/A	N/A
2	Apply filter	status == 'sold'	Only documents with status 'sold'	N/A	N/A
3	Run aggregation	N/A	Filtered documents	Sum price field	Sum of prices for sold items
4	Return result	N/A	N/A	N/A	{"filtered_sales":{"doc_count":3,"total_price":{"value":450}}}

💡 Aggregation completes after filtering and summing prices of matching documents.

Variable Tracker

Variable	Start	After Filter	After Aggregation	Final
Documents	All documents	Filtered to status='sold'	Aggregation on filtered docs	Aggregation result returned
doc_count	N/A	3 (example count)	N/A	3
total_price	N/A	N/A	450 (example sum)	450

Key Moments - 2 Insights

Why does the aggregation only include some documents?

Because the filter aggregation first selects documents matching the filter condition (see execution_table step 2), only those documents are used in the aggregation.

What happens if no documents match the filter?

The aggregation runs on zero documents, so the result will show doc_count as 0 and aggregation values as zero or null (see variable_tracker doc_count after filter).

Visual Quiz - 3 Questions

Look at the execution_table at step 2, what documents are selected?

A All documents in the index

B Documents where price is zero

C Documents where status is 'sold'

D No documents

💡 Hint

Check the 'Documents Selected' column at step 2 in execution_table.

At which step is the sum of the price field calculated?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Look at the 'Aggregation Performed' column in execution_table.

If the filter changed to status='available', how would the doc_count change?

A It would be the count of documents with status 'available'

B It would stay the same

C It would be zero always

D It would count all documents

💡 Hint

Refer to variable_tracker doc_count after filter and how filter affects document selection.

Concept Snapshot

Filter aggregation syntax:
{
  "aggs": {
    "name": {
      "filter": { <filter_query> },
      "aggs": { <sub_aggregations> }
    }
  }
}

Behavior: Filters documents first, then runs sub-aggregations only on those.
Key rule: Aggregations inside filter only see filtered docs.

Full Transcript

Filter aggregation in Elasticsearch works by first applying a filter condition to select only documents that match. Then, it performs aggregations like sum or average only on those filtered documents. For example, filtering documents where status is 'sold' and summing their price fields. The execution steps are: start query, apply filter, run aggregation on filtered docs, and return results. Variables like doc_count track how many documents matched the filter. If no documents match, aggregation results reflect zero or null values. Changing the filter changes which documents are included and thus changes aggregation results.