I want to show Top 10 records and apply filter for specific fields in Elastic search

Question

This is the query to get the Top 10 records. There is a Field name Answer inside this we have a record "UNHANDLED". I want to exclude the UNHANDLED inside the Answer field.

How to write the query to get both Top 10 and Exclude UNHANDLED

GET /logstash-sdc-mongo-abcsearch/_search?size=0 

{
  "aggs": {
    "top_tags": {
      "terms": {
        "field": "question.keyword"
      },
      "aggs": {
        "top_faq_hits": {
          "top_hits": {
            "_source": {
              "includes": [
                "answer"
              ]
            },
            "size": 1
          }
        }
      }
    }
  }
}

Answer 1

You can use the must_not clause, to exclude the documents that containsUNHANDLED in the answer field. Try out the below query -

Index Mapping:

{
  "mappings": {
    "properties": {
      "question": {
        "type": "keyword"
      },
      "answer": {
        "type": "keyword"
      }
    }
  }
}

Index Data:

{
  "question": "a",
  "answer": "b"
}
{
  "question": "c",
  "answer": "UNHANDLED"
}

Search Query:

{
  "query": {
    "bool": {
      "must_not": {
        "term": {
          "answer": "UNHANDLED"
        }
      }
    }
  },
  "aggs": {
    "top_tags": {
      "terms": {
        "field": "question"
      },
      "aggs": {
        "top_faq_hits": {
          "top_hits": {
            "_source": {
              "includes": [
                "answer"
              ]
            },
            "size": 1
          }
        }
      }
    }
  }
}

Search Result:

"aggregations": {
    "top_tags": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "a",
          "doc_count": 1,
          "top_faq_hits": {
            "hits": {
              "total": {
                "value": 1,
                "relation": "eq"
              },
              "max_score": 0.0,
              "hits": [
                {
                  "_index": "65563925",
                  "_type": "_doc",
                  "_id": "1",
                  "_score": 0.0,
                  "_source": {
                    "answer": "b"
                  }
                }
              ]
            }
          }
        }
      ]
    }
  }

Update 1:

Based on the comments below, try out the below query:

{
  "query": {
    "bool": {
      "must_not": {
        "term": {
          "answer": "UNHANDLED"
        }
      },
      "must": {
        "term": {
          "source": "sonax"
        }
      }
    }
  },
  "aggs": {
    "top_tags": {
      "terms": {
        "field": "question"
      },
      "aggs": {
        "top_faq_hits": {
          "top_hits": {
            "_source": {
              "includes": [
                "answer"
              ]
            },
            "size": 1
          }
        }
      }
    }
  }
}