Get total number of documents along with filtered document count from elastic search kibana

Question

I have an Elastic search documents where I am storing the user detail. Document format is as below:

{
  "took": 2,
  "timed_out": false,
  "_shards": {
    "total": 3,
    "successful": 3,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 3,
    "max_score": 11.420451,
    "hits": [
      {
        "_index": "v1_users_index",
        "_type": "doc",
        "_id": "IWu40",
        "_score": 11.420451,
        "_source": {
          "country": "IN",
          "state": "MH",
          "district": "PU",
          "zipCode": 123456,
          "tag": "employee",
          "email": "fake123@xyz.com"
        }
      },
      {
        "_index": "v1_users_index",
        "_type": "doc",
        "_id": "iBR20",
        "_score": 11.420451,
        "_source": {
          "country": "IN",
          "state": "UP",
          "district": "AB",
          "zipCode": "098765,
          "tag": "manager",
          "email": "fakeManager@xyz.com"
        }
      }
      .
      .
      .
      .
    ]
  }
}

Now I am applying filter on the given indexed document based on the document fields, query is as below

GET v1_users_index/_search?
{
    "query": {
        "bool": {
            "must": [{
                "match": {
                    "country.keyword": "IN"
                }
            }]
        }
    }
}

Above query will return all the records that has country code as IN along with total number of records. (We are getting total number from the hits json)

Now I am trying to write a query such that it can return total number of documents under given index as well as total number of documents after filter

Ex. if there are 500 users document present under given ES index and after applying country filter it is returning 50 users document.

{
 total_document: 500,
 filtered_document: 50
}

So can anyone please let me know how can I do this. Thanks.

Answer 1

Use a filtered aggregation on query to get the above number and use another terms aggregation on virtual term _index to get total docs. query could be a match_all query or nothing