title: Filter bucket in elasticsearch
body: <p>I have a watcher that filters data by 3 fields, I call them level 1, level and level 3:</p>
  <pre><code>&quot;aggs&quot;: {
    &quot;group_by_level_1&quot;: {
      &quot;terms&quot;: {
        &quot;field&quot;: &quot;level1.keyword&quot;
      },
      &quot;aggs&quot;: {
        &quot;group_by_level_2&quot;: {
          &quot;terms&quot;: {
            &quot;field&quot;: &quot;level2.keyword&quot;
          },
          &quot;aggs&quot;: {
            &quot;group_by_level_3&quot;: {
              &quot;terms&quot;: {
                &quot;field&quot;: &quot;level3.keyword&quot;
              }
            }
          }
        }
      }
    }
  }
  </code></pre>
  <p>It returns the following result:</p>
  <pre><code>{
    &quot;aggregations&quot;: {
      &quot;group_by_level_1&quot;: {
        &quot;doc_count_error_upper_bound&quot;: 0,
        &quot;sum_other_doc_count&quot;: 0,
        &quot;buckets&quot;: [
          {
            &quot;doc_count&quot;: 70,
            &quot;group_by_level_2&quot;: {
              &quot;doc_count_error_upper_bound&quot;: 0,
              &quot;sum_other_doc_count&quot;: 0,
              &quot;buckets&quot;: [
                {
                  &quot;doc_count&quot;: 47,
                  &quot;group_by_level_3&quot;: {
                    &quot;doc_count_error_upper_bound&quot;: 0,
                    &quot;sum_other_doc_count&quot;: 0,
                    &quot;buckets&quot;: [
                      {
                        &quot;doc_count&quot;: 46,
                        &quot;key&quot;: &quot;key_level_3_1&quot;
                      }
                    ]
                  },
                  &quot;key&quot;: &quot;key_level_2_1&quot;
                },
                {
                  &quot;doc_count&quot;: 8,
                  &quot;group_by_level_3&quot;: {
                    &quot;doc_count_error_upper_bound&quot;: 0,
                    &quot;sum_other_doc_count&quot;: 0,
                    &quot;buckets&quot;: [
                      {
                        &quot;doc_count&quot;: 3,
                        &quot;key&quot;: &quot;key_level_3_2&quot;
                      },
                      {
                        &quot;doc_count&quot;: 2,
                        &quot;key&quot;: &quot;key_level_3_3&quot;
                      }
                    ]
                  },
                  &quot;key&quot;: &quot;key_level_2_2&quot;
                },
                {
                  &quot;doc_count&quot;: 4,
                  &quot;group_by_level_3&quot;: {
                    &quot;doc_count_error_upper_bound&quot;: 0,
                    &quot;sum_other_doc_count&quot;: 0,
                    &quot;buckets&quot;: [
                      {
                        &quot;doc_count&quot;: 4,
                        &quot;key&quot;: &quot;key_level_3_5&quot;
                      }
                    ]
                  },
                  &quot;key&quot;: &quot;key_level_2_3&quot;
                }
              ]
            },
            &quot;key&quot;: &quot;key_level_1_1&quot;
          }
        ]
      }
    }
  }
  </code></pre>
  <p>How do i get the key value level 1, level 2 and 3 satisfying the condition level 3 doc_count &gt; 10?</p>
  <p>I tried:</p>
  <pre><code>&quot;aggs&quot;: {
      &quot;group_by_level_3&quot;: {
          &quot;terms&quot;: {
              &quot;field&quot;: &quot;level3.keyword&quot;,
              &quot;min_doc_count&quot;: 10
          }
       }
  }
  </code></pre>
  <p>But this only helps me to hide the value of level 3, how can i get only bucket level 1, 2 that satisfy the condition level 3 &gt; 10:</p>
  <pre><code>{
    &quot;aggregations&quot;: {
      &quot;group_by_level_1&quot;: {
        &quot;doc_count_error_upper_bound&quot;: 0,
        &quot;sum_other_doc_count&quot;: 0,
        &quot;buckets&quot;: [
          {
            &quot;doc_count&quot;: 49,
            &quot;group_by_level_2&quot;: {
              &quot;doc_count_error_upper_bound&quot;: 0,
              &quot;sum_other_doc_count&quot;: 0,
              &quot;buckets&quot;: [
                {
                  &quot;doc_count&quot;: 34,
                  &quot;group_by_level_3&quot;: {
                    &quot;doc_count_error_upper_bound&quot;: 0,
                    &quot;sum_other_doc_count&quot;: 0,
                    &quot;buckets&quot;: [
                      {
                        &quot;doc_count&quot;: 33,
                        &quot;key&quot;: &quot;key_level_3_1&quot;
                      }
                    ]
                  },
                  &quot;key&quot;: &quot;key_level_2_1&quot;
                },
                {
                  &quot;doc_count&quot;: 4,
                  &quot;group_by_level_3&quot;: {
                    &quot;doc_count_error_upper_bound&quot;: 0,
                    &quot;sum_other_doc_count&quot;: 0,
                    **&quot;buckets&quot;: []**
                  },
                  &quot;key&quot;: &quot;key_level_2_2&quot;
                },
                {
                  &quot;doc_count&quot;: 3,
                  &quot;group_by_level_3&quot;: {
                    &quot;doc_count_error_upper_bound&quot;: 0,
                    &quot;sum_other_doc_count&quot;: 0,
                    **&quot;buckets&quot;: []**
                  },
                  &quot;key&quot;: &quot;key_level_2_3&quot;
                }
              ]
            },
            &quot;key&quot;: &quot;key_level_1_1&quot;
          }
        ]
      }
    }
  }
  </code></pre>