Elasticsearch add range filter to aggregation

Question

I'm not experimented in elasticsearch and I have to add a range filter for the field "data.elements.id_element" to the next query:

{
    "aggs": {
      "2": {
        "date_histogram": {
          "field": "@timestamp",
          "calendar_interval": "1d",
          "min_doc_count": 1
        },
        "aggs": {
          "elementId": {
            "terms": {
              "field": "data.elements.id_element",
              "order": {
                "_count": "desc"
              },
              "size": 1000
            },
            "aggs": {
              "Device": {
                "filters": {
                },
                "aggs": {
                }
              }
            }
          }
        }
      }
    },
    "size": 0,
    "docvalue_fields": [
      {
        "field": "@timestamp",
        "format": "date_time"
      }
    ],
    "query": {
      "bool": {
        "filter": [
          {
            "range": {
              "@timestamp": {
                "gte": "startDate",
                "lte": "endDate",
                "format": "strict_date_optional_time"
              }
            }
          }
        ]
      }
    }
  } 

I've tried to add to the range part like this, but it's ignored :

{
    "aggs": {
      "2": {
        "date_histogram": {
          "field": "@timestamp",
          "calendar_interval": "1d",
          "min_doc_count": 1
        },
        "aggs": {
          "elementId": {
            "terms": {
              "field": "data.elements.id_element",
              "order": {
                "_count": "desc"
              },
              "size": 1000
            },
            "aggs": {
              "Device": {
                "filters": {
                },
                "aggs": {
                }
              }
            }
          }
        }
      }
    },
    "size": 0,
    "docvalue_fields": [
      {
        "field": "@timestamp",
        "format": "date_time"
      }
    ],
    "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "startDate",
              "lte": "endDate",
              "format": "strict_date_optional_time"
            }
          }
        },
        {
          "range": {
            "data.elements.id_element": {
              "gte": 1,
              "lte": 1001
            }
          }
        }
      ]
    }
  }
}

I've tried this too:

{
    "aggs": {
      "2": {
        "date_histogram": {
          "field": "@timestamp",
          "calendar_interval": "1d",
          "min_doc_count": 1
        },
        "aggs": {
          "elementId": {
            "terms": {
              "field": "data.elements.id_element",
              "order": {
                "_count": "desc"
              },
              "size": 1000
            },
            "aggs": {
              "Device": {
                "filters": {
                },
                "aggs": {
                }
              }
            }
          }
        }
      }
    },
    "size": 0,
    "docvalue_fields": [
      {
        "field": "@timestamp",
        "format": "date_time"
      }
    ],
     "query": {
      "bool": {
      "must": [
        {
          "query_string": {
            "query": "data.elements.id_element:[1 TO 1001]",
            "analyze_wildcard": true,
          }
        }
      ],
        "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "startDate",
              "lte": "endDate",
              "format": "strict_date_optional_time"
            }
          }
        }
      ]
      }
    }
  }

Same result, aleatoire elements id and does not respect the range filter/condition. plz any idea.

Thanks.

Answer 1

For others who can face the same problem, I used partition so I've dispatched my query into many queries following this doc:

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_filtering_values_with_partitions

Maybe there is better solution, but this what worked for me in my context.

Answer 2

Considering, that you want to apply filter on a particular aggregation, this can be done as below:

{
   "aggs": {
    "elementId": {
      "aggs": {
        "elementId": {
          "terms": {
              "field": "data.elements.id_element",
              "order": {
                "_count": "desc"
              },
              "size": 1000
            }
        }
      },
      "filter": {
        "bool": {
          "filter": [
            {
              "range": {
              "@timestamp": {
              "gte": "startDate",
              "lte": "endDate",
              "format": "strict_date_optional_time"
            }
          }
            }
          ]
        }
      }
    }
  }
 }