How to do AND / OR in Filter Aggregation

Question

In https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filter-aggregation.html we learn:

{
    "aggs" : {
        "t_shirts" : {
            "filter" : { "term": { "type": "t-shirt" } }
        }
    }
}

The above code show how we can aggs for t-shirt, but how do we do:

{
    "aggs" : {
        "t_shirts_or_shorts" : {
            "filter" : { "term": { "type": "t-shirt" } OR "term": { "type": "shorts" } }
        }
    }
}

and

{
    "aggs" : {
        "black_t_shirts" : {
            "filter" : { "term": { "type": "t-shirt" } AND "term": { "color": "black" } }
        }
    }
}

Answer 1

You can use "must" and should clause in filter aggregation same as in query.

Query1:

{
  "size": 0, 
  "aggs": {
    "t_shirts": {
      "filter": {
        "bool": {
          "should": [
            {
              "term": {
                "type.keyword": "t-shirt"
              }
            },
            {
              "term": {
                "type.keyword": "shorts"
              }
            }
          ]
        }
      }
    }
  }
}

Query2:

{
  "size": 0, 
  "aggs": {
    "t_shirts": {
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "type.keyword": "t-shirt"
              }
            },
            {
              "term": {
                "color.keyword": "black"
              }
            }
          ]
        }
      }
    }
  }
}

Answer 2

You can combine filter criteria using the bool tag, much like you can query clauses. You can also check this: Multiple filters and an aggregate in elasticsearch