Filters aggregation #

A multi-bucket aggregation where each bucket is defined by a named filter — all filters run over the same document set, giving per-filter counts (and nested sub-aggregations) side by side.

Examples #

POST /logs/_search
{
  "aggs": {
    "messages": {
      "filters": {
        "filters": {
          "errors":   { "match": { "field": "level", "query": "error" } },
          "warnings": { "match": { "field": "level", "query": "warn" } }
        }
      }
    }
  }
}

An anonymous array of filters is also accepted; its buckets are keyed "0", "1", …

Parameters for filters #

• filters
  (Required, object or array) Named filter definitions — a map from bucket name to query clause, or an array of query clauses (keys become "0", "1", …).
• aggs
  (Optional, object) Nested sub-aggregations, computed per bucket.