Aggregation, group by and histogram in a single query for nested fields

Elastic Stack Elasticsearch
1

Query:

{
 "size": 0,
 "query": {
"bool": {
  "must": [
    {
      "range": {
        "timestamp": {
          "from": 1568110120010,
          "to": 1569824176000,
          "include_lower": true,
          "include_upper": true,
          "boost": 1.0
        }
      }
    }
  ],
  "adjust_pure_negative": true,
  "boost": 1.0
}
},
 "aggregations": {
 "clientPorttopKByCount.key": {
   "nested": {
       "path": "clientPorttopKByCount"
    },
   "aggregations": {
    "orders": {
      "terms": {
        "field": "clientPorttopKByCount.key",
        "size": 10,
        "min_doc_count": 1,
        "shard_min_doc_count": 0,
        "show_term_doc_count_error": false,
        "order": [
          {
            "_count": "desc"
          },
          {
            "_key": "asc"
          }
        ]
      },
      "aggregations": {
        "clientPorttopKByCount.value_sum": {
          "sum": {
            "field": "clientPorttopKByCount.value"
          }
        },
        "records": {
          "reverse_nested": {
            
          },
          "aggregations": {
            "histogram": {
              "histogram": {
                "field": "timestamp",
                "interval": 180000.0,
                "offset": 0.0,
                "order": {
                  "_key": "asc"
                },
                "keyed": false,
                "min_doc_count": 0
              }
            }
          }
        }
       }
     }
   }
 }
}
}

output:

{
 "took": 16,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 110,
"max_score": 0.0,
"hits": [
  
]
},
 "aggregations": {
"clientPorttopKByCount.key": {
  "doc_count": 290,
  "orders": {
    "doc_count_error_upper_bound": 3,
    "sum_other_doc_count": 254,
    "buckets": [
      {
        "key": "16784",
        "doc_count": 15,
        "records": {
          "doc_count": 15,
          "histogram": {
            "buckets": [
              {
                "key": 1.56949614E12,
                "doc_count": 5
              },
              {
                "key": 1.56949632E12,
                "doc_count": 6
              },
              {
                "key": 1.5694965E12,
                "doc_count": 4
              }
            ]
          }
        },
        "clientPorttopKByCount.value_sum": {
          "value": 1508.0
        }
      },
      {
        .....
      }
    }
  }


 expected response: 
 {
....
......
"buckets": [
              {
                "key": 1.56949614E12,
                "doc_count": 5,
                "clientPorttopKByCount.value_sum": {
                 "value": 1508.0
                }
              },
  ....
 .......
 }
}

So I want the sum for each bucket element..

Can anyone help me please.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.