# Aggregation: find time-window with the maximum documents
**URL:** https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742
**Category:** Elasticsearch
**Created:** [April 4, 2018, 12:55pm UTC](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742 "2018-04-04T12:55:24Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@ebuildy](https://discuss.elastic.co/u/ebuildy)
#### Post date: [April 4, 2018, 12:55pm UTC](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742/1 "2018-04-04T12:55:24Z")
Given a time-serie of events, by day, I want to know the "hour:minute" which has the maximum of documents.
Ex. document: { "date" : "...", "event" : "search" }
I have tried to follow [https://www.elastic.co/blog/implementing-a-statistical-anomaly-detector-part-1](https://www.elastic.co/blog/implementing-a-statistical-anomaly-detector-part-1) but didnt manage to have only the datetime.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [April 9, 2018, 8:32am UTC](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742/2 "2018-04-09T08:32:37Z")
Hey,
is this what you are after?
```auto
PUT foo/bar/_bulk
{ "index" : {} }
{ "date" : "2018-04-09T12:32" }
{ "index" : {} }
{ "date" : "2018-04-09T12:33" }
{ "index" : {} }
{ "date" : "2018-04-09T12:33" }
{ "index" : {} }
{ "date" : "2018-04-09T12:33" }
{ "index" : {} }
{ "date" : "2018-04-09T12:34" }
{ "index" : {} }
{ "date" : "2018-04-09T12:34" }
GET foo/bar/_search
{
"size": 0,
"aggs": {
"date": {
"date_histogram": {
"field": "date",
"interval": "1m",
"order": {
"_count": "desc"
}
}
}
}
}
```
---
### Author:  [@ebuildy](https://discuss.elastic.co/u/ebuildy)
#### Post date: [April 9, 2018, 8:41am UTC](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742/3 "2018-04-09T08:41:29Z")
Hello, thanks you.
This will give me ALL the tuple "hour:minute" 😕 I want to get only the "bigger" one.
---
### Author:  [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)
#### Post date: [April 9, 2018, 8:48am UTC](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742/5 "2018-04-09T08:48:10Z")
Or only with minimum counts.
```
GET foo/bar/_search
{
"size": 0,
"aggregations": {
"timeslice": {
"histogram": {
"script": "doc['date'].date.getHourOfDay()",
"interval": 1,
"min_doc_count": 1,
"extended_bounds": {
"min": 0,
"max": 23
},
"order": {
"_count": "desc"
}
},
"aggregations": {
"date": {
"date_histogram": {
"min_doc_count": 0,
"field": "date",
"interval": "1m",
"order": {
"_count": "desc"
}
}
}
}
}
}
}
```
This gives back the busiest hour, and then in a sub bucket the highest minute. You can set a limit as well for getting back only the highest hour and minute.
---
### Author:  [@ebuildy](https://discuss.elastic.co/u/ebuildy)
#### Post date: [April 9, 2018, 3:10pm UTC](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742/6 "2018-04-09T15:10:05Z")
I am not sure histogram supports limit or size, this is all the problem ^^
---
### Author:  [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)
#### Post date: [April 9, 2018, 5:12pm UTC](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742/7 "2018-04-09T17:12:24Z")
Ah oke, sorry misunderstood. Histogram does not seem to support a size for all I know as well.
---
### Author:  [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)
#### Post date: [April 9, 2018, 6:07pm UTC](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742/8 "2018-04-09T18:07:38Z")
How about this with painless. It is fast here also:
```
GET foo/bar/_search
{
"size": 0,
"aggregations": {
"hour": {
"terms": {
"script": "doc['date'].date.getHourOfDay()",
"min_doc_count": 1,
"size": 1,
"order": {
"_count": "desc"
}
},
"aggregations": {
"minute": {
"terms": {
"script": "doc['date'].date.getMinuteOfHour()",
"min_doc_count": 1,
"size": 1,
"order": {
"_count": "desc"
}
}
}
}
}
}
}
```
In ES6.X
```
GET foo/bar/_search
{
"size": 0,
"aggregations": {
"hour": {
"terms": {
"script": "doc['date'].value.hourOfDay",
"min_doc_count": 1,
"size": 1,
"order": {
"_count": "desc"
}
},
"aggregations": {
"minute": {
"terms": {
"script": "doc['date'].value.minuteOfHour",
"min_doc_count": 1,
"size": 1,
"order": {
"_count": "desc"
}
}
}
}
}
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 7, 2018, 6:07pm UTC](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742/9 "2018-05-07T18:07:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.