ES聚合后根据 doc_count 进行过滤

需求：
统计具有相同flow_id的日志数量，并过滤统计数量大于等于1000条的日志。

GET index_*/_search?size=0
{

  "aggs": {
    "age_terms": {
      "terms": {
        "field": "flow_id"
        },
        "aggs":{
        "having": {
          "bucket_selector": {
            "buckets_path": { 
              "view_count": "_count"
            },
            "script": "params.view_count < 1000"
          }
        }
        }
      }
    },
  "query":{
    "bool":{
      "must":[
    {"match":{
      "event_type":"alert"
    }
    }
    ]
  }
  }
}

参考：
https://www.cnblogs.com/Finley/p/9499534.html
https://my.oschina.net/bingzhong/blog/1975879
https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline.html
https://discuss.elastic.co/t/filter-based-on-the-doc-count-with-aggregations/62677