Elasticsearch. Using term aggregation, return values where doc count is less than some value

Question

I want to group values by field(account id in my case) using term aggregation and return only fields where doc_count is less than some value.

I can specify min_doc_count parameter, but there is no max_doc_count. So I'm looking for a way to simulate this behavior. One of my many tries is this, but it doesn't work.

{
  "size": 0,
  "aggs": {
    "by_account": {
      "terms": {
        "field": "accountId"
      },
      "aggs": {
        "by_account_filtered": {
          "bucket_selector": {
            "buckets_path": {
              "totalDocs": "_count"
            },
            "script": "params.totalDocs < 10000"
          }
        }
      }
    }
  }
}

What am I doing wrong?

Answer 1

The bucket_selector aggregation need to be nested ( since its a parent-type aggregation ) and sibling of a metric aggregation that it will use to filter buckets.

So we use a top level terms aggregation, then use a nested value_count aggregation to expose the bucket doc_count to the sibling selector_bucket aggregation

try this :

{
  "size": 0,
  "aggs": {
    "by_account": {
      "terms": {
        "field": "accountId"
      },
      "aggs": {
        "by_account_number": {
          "value_count" : {
            "field" : "accountId"
          }
        },
        "by_account_filtered": {
          "bucket_selector": {
            "buckets_path": {
              "totalDocs": "by_account_number"
            },
            "script": "params.totalDocs < 10000"
          }
        }
      }
    }

  }
}

EDIT : If you want to get the lowest account doc_count

{
      "size": 0,
      "aggs": {
        "by_account": {
          "terms": {
            "field": "accountId",
            "order" : { "_count" : "asc" },
            "size": 100
          },
          "aggs": {
            "by_account_number": {
              "value_count" : {
                "field" : "accountId"
              }
            },
            "by_account_filtered": {
              "bucket_selector": {
                "buckets_path": {
                  "totalDocs": "by_account_number"
                },
                "script": "params.totalDocs < 10000"
              }
            }
          }
        }

      }
    }