title: Mix nested query with scripted filter
body: <h1>Context</h1>
  
  <p>We have data about malware in elasticsearch. We must analyse it with kibana. For each sample (malware), we have some SSL certificates. These are nested fields. I'm new to elasticsearch and have difficulties to find what I want in the official documentation.</p>
  
  <h1>What I want</h1>
  
  <p>I want to be able to create a chart (ie: Line chart) respecting these rules:</p>
  
  <ul>
  <li>Simple count on the Y Axis</li>
  <li>Certificate file name on the X Axis</li>
  <li>Show only Subject == Issuer</li>
  </ul>
  
  <h1>The simplified mapping</h1>
  
  <pre><code>{
      "mappings":{  
          "sample":{
              "properties":{
                  "static":{
                          "x509Certificates":{
                              "type":"nested",
                              "properties":{
                                  "Status":{
                                      "type":"long"
                                  },
                                  "FileName":{
                                      "type":"keyword"
                                  },
                                  "Serial":{
                                      "type":"long"
                                  },
                                  "Signature":{
                                      "type":"keyword"
                                  },
                                  "PublicKey":{
                                      "type":"keyword"
                                  },
                                  "NotValidBefore":{
                                      "type":"date",
                                      "format":"epoch_millis"
                                  },
                                  "NotValidAfter":{
                                      "type":"date",
                                      "format":"epoch_millis"
                                  },
                                  "Subject":{
                                      "type":"keyword"
                                  },
                                  "Issuer":{
                                      "type":"keyword"
                                  }
                              }
                          }
                      }
                  }
              }
          }
      }
  }
  </code></pre>
  
  <h1>Things I already tried</h1>
  
  <h3>Not using nested objects</h3>
  
  <p>It's not working because there is no "join". The chart is created, but the information worth nothing.</p>
  
  <h3>Using the kibana nested fork</h3>
  
  <p><a href="https://github.com/homeaway/kibana/tree/nestedSupport-5.2" rel="nofollow noreferrer">https://github.com/homeaway/kibana/tree/nestedSupport-5.2</a>
  It's actually helping. Atleast we can generate a graph with the nested fields. But it did not completely resolve the problem.</p>
  
  <h3>Using scripted query in the search bar on the top of the chart</h3>
  
  <p>The query was similar to:</p>
  
  <pre><code> {
     "bool": {
       "must": {
          "script": {
             "script": {
                "inline": "doc['Subject'].value == doc['Issuer'].value",
                "lang": "painless"
                }
             }
          }
       }
   }
  </code></pre>
  
  <p>I'm not sure at all, but it's like if it search for at least one of both value being equals between all the certificates.</p>
  
  <h3>Using scripted fields</h3>
  
  <p>I have created a simple boolean scripted field similar to:</p>
  
  <pre><code>doc['Subject'].value == doc['Issuer'].value
  </code></pre>
  
  <p>And created a query for the boolean being true. It was partially working. </p>
  
  <h3>Nested query</h3>
  
  <p>It really looks like what I want BUT, I don't know how to say Issuer==Subject with this method.</p>
  
  <h1>My question</h1>
  
  <p>What is the easiest way to solve my problem knowing that this is not our only use case that need nested scripted filters?</p>
  
  <p>Don't hesitate to ask for clarification!</p>