Finding union or intersection of buckets using elasticsearch aggregations

Question

i have nested aggregations and i want to find union or intersections of 2nd aggregations buckets based on conditions on my 1st aggregation bucket results.For eg this my aggregation.

    "aggs": {
    "events": {
        "terms": {
            "field": "event_name"
        },
        "aggs":{
            "devices":{
                "terms":{
                    "field": "device-id"
                }
            }
        }
    }

}

And this the result of my aggregation

 "aggregations": {
  "events": {
     "doc_count_error_upper_bound": 0,
     "sum_other_doc_count": 0,
     "buckets": [
        {
           "key": "conversion_checkout",
           "doc_count": 214,
           "devices": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 6,
              "buckets": [
                 {
                    "key": "9a11f243d44",
                    "doc_count": 94
                 },
                 {
                    "key": "ddcb21fd6cb",
                    "doc_count": 35
                 }

              ]
           }
        },
        {
           "key": "action_view_product",
           "doc_count": 5,
           "devices": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                 {
                    "key": "54E4C593",
                    "doc_count": 4
                 },
                 {
                    "key": "9a11f243d44",
                    "doc_count": 1
                 }
              ]
           }
        }
     ]
  }

}

Now if i want to find all the devices which have done action_view_product and conversion_checkout how do i do it in aggregations?

Answer 1

I think you want to get all the device-ids having event_names action_view_product and conversion_checkout as follows-

{  
   "aggregations":{  
      "devices_agg":{  
         "doc_count":516,
         "devices":{  
            "doc_count_error_upper_bound":0,
            "sum_other_doc_count":0,
            "buckets":[  
               {  
                  "key":623232334,
                  "doc_count":275
               },
               {  
                  "key":245454512,
                  "doc_count":169
               },
               {  
                  "key":345454567,
                  "doc_count":32
               },
               {  
                  "key":578787565,
                  "doc_count":17
               },
               {  
                  "key":146272715,
                  "doc_count":23
               }
            ]
         }
      }
   }
}

The doc_count = 516 is the total number of documents having event_names either action_view_product or conversion_checkout and "key" in the devices aggregation is device-id.

If I get you correct, then below query will do the thing for you-

{
   "size": 0,
   "aggs": {
      "devices_agg": {
         "filter": {
            "bool": {
               "must": [
                  {
                     "terms": {
                        "event_name": [
                           "action_view_product",
                           "conversion_checkout"
                        ]
                     }
                  }
               ]
            }
         },
         "aggs": {
            "devices": {
               "terms": {
                  "field": "device-id",
                  "size": 100
               }
            }
         }
      }
   }
}

Let me know if I got you wrong.