Elasticsearch：按分组文档中的条件过滤

Question

I need to filter aggregation results by a condition that says that at least one of the documents grouped must have a field with a certain content. My data is a kind of traces of events occurred to different processes, a unique process has many traces.

Example of my data:

proc_id event   timestamp
1       ON      1000
1       EV1     1001
2       ON      1002
1       OFF     1003
3       ON      1004
2       EV2     1005
3       EV1     1006
3       EV_END  1007
2       EV_END  1008

For example, I need to group by proc_id, just the proc_id that has at least one EV_END event. Taking just the EV_END traces is not the solution because I need to process things (like times and number of events), later, with all the traces of the proc_id.

I saw that from version 2.x there are bucket_selectors and scripts but I'm not getting the idea.

The pseudo query with what I want to do:

curl -XPOST 'localhost:9200/proc/_search?pretty' -d '
{
    "query": { "match_all": {} },
    "aggs": {
        "group_by_proc_id": {
            "terms": {
             "field": "proc_id",
             **ONLY if proc has at least one trace with event == 'EV_END'**
            }
        }
    }
}'

Answer 1

I think you could use filter aggregation to get proc_ids where EV_END event is present.

{
  "query": {
    "match_all": {}
  },
  "size": 0,
  "aggs": {
    "EV_END": {
      "filter": {
        "term": {
          "event": "EV_END"
        }
      },
      "aggs": {
        "proc_group": {
          "terms": {
            "field": "proc_id",
            "size": 10
          }
        }
      }
    }
  }
}