# Aggregate on string prefix extract value from suffix

**URL:** <https://discuss.elastic.co/t/aggregate-on-string-prefix-extract-value-from-suffix/243984>\
**Category:** Elasticsearch\
**Created:** [August 6, 2020, 9:01am UTC](https://discuss.elastic.co/t/aggregate-on-string-prefix-extract-value-from-suffix/243984 "2020-08-06T09:01:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yonatan\_Omer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yonatan_omer/32/42450_2.png) [@Yonatan\_Omer](https://discuss.elastic.co/u/Yonatan_Omer)\
**Post date:** [August 6, 2020, 9:01am UTC](https://discuss.elastic.co/t/aggregate-on-string-prefix-extract-value-from-suffix/243984/1 "2020-08-06T09:01:17Z")

</div>

In our case we have unknown number of metric types.  
In order to avoid nested types due to the known problem Locene flattening the objects, and avoid mapping explosion, I'm considering using (prefixed) flat strings and do you grouping by extracting the value from the string.  
so the model would be:

```auto
{
   "tasks": [
       "taskA@cpu@14567",
       "taskA@time@24567",
       "taskB@cpu@14567",
       "taskB@time@24567",
       ...
   ]
}

```

is it possible to obtain a moving average histogram, by using a script to filter by task prefix and extracting value from the suffix?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2020, 9:01am UTC](https://discuss.elastic.co/t/aggregate-on-string-prefix-extract-value-from-suffix/243984/2 "2020-09-03T09:01:22Z")

</div>

Closed on September 3, 2020, 9:01am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.