# Bucket\_script location
**URL:** https://discuss.elastic.co/t/bucket-script-location/148366
**Category:** Elasticsearch
**Created:** [September 12, 2018, 6:00pm UTC](https://discuss.elastic.co/t/bucket-script-location/148366 "2018-09-12T18:00:58Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)
#### Post date: [September 12, 2018, 6:00pm UTC](https://discuss.elastic.co/t/bucket-script-location/148366/1 "2018-09-12T18:00:59Z")
I would like to construct a query that would calculate a moving average. The working query is below. I need to do an initial query for the specific function to be analyzed. After that I am doing a four week from present sample in 15 minute intervals. The return condition is true/false and I need a percentage of false returns. I need the scripted percentage (total\_fails.doc\_count / time\_slices.doc\_count) in the time\_slices buckets. I think I need a bucket\_script but I can't seem to get it in the right place. I either get a "No aggregation found for path.... or a Only sibling pipeline aggregations are allowed at the top level error.
"percent\_fails": {
"bucket\_script": {
"buckets\_path": {"fail\_count": "total\_fails.doc\_count", "total\_count": "doc\_count"},
"script": "fail\_count / pass\_count \* 100"
}
}
```
GET sasha-*/_search
{
"size": 0,
"query": {
"bool": {
"must_not": [{
"match_phrase": {
"returned_xml": "AssetSearch: Missing attuid"
}
},
{
"match_phrase": {
"returned_xml": "not found in GPS, IPDB or NC3"
}
},
{
"match_phrase": {
"returned_xml": "enterprise_customer_asset_list failed"
}
},
{
"match_phrase": {
"returned_xml": "Missing AssetID, ticketNumber, circuit_id"
}
},
{
"match_phrase": {
"returned_xml": "is not a telephone number"
}
},
{
"match_phrase": {
"returned_xml": "Missing platform_object_key"
}
},
{
"match_phrase": {
"returned_xml": "Can't find any info on MAC address"
}
}],
"must": [{
"term": {
"functional_name.keyword": {
"value": "getAssetInformation"
}
}
},
{
"range": {
"@timestamp": {
"gte": "now-4w",
"lte": "now"
}
}
}]
}
},
"aggs": {
"time_slices": {
"date_histogram": {
"field": "@timestamp",
"interval": "15m"
},
"aggs": {
"total_fails": {
"filter": {
"term": {
"return_condition": "true"
}
}
}
}
}
}
}
{
```
"took": 88,
"timed\_out": false,
"\_shards": {
"total": 215,
"successful": 215,
"failed": 0
},
"hits": {
"total": 106506,
"max\_score": 0,
"hits": []
},
"aggregations": {
"time\_slices": {
"buckets": [
{
"key\_as\_string": "2018-08-15T17:15:00.000Z",
"key": 1534353300000,
"doc\_count": 21,
"total\_fails": {
"doc\_count": 0
}
},
{
"key\_as\_string": "2018-08-15T17:30:00.000Z",
"key": 1534354200000,
"doc\_count": 104,
"total\_fails": {
"doc\_count": 0
}
},
---
### Author:  [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)
#### Post date: [September 12, 2018, 8:50pm UTC](https://discuss.elastic.co/t/bucket-script-location/148366/2 "2018-09-12T20:50:04Z")
I have cobbled together a query, however now I have to fight painless. The buckets will not always be present so total\_fail and total\_pass will not always be defined. I've tried isDefined() and typeof == 'undefined'. No luck. Help from painless masters out there?
```
"aggs": {
"time_slices": {
"date_histogram": {
"field": "@timestamp",
"interval": "15m"
},
"aggs": {
"fail_bucket": {
"filter": {
"term": {
"return_condition": "true"
}
},
"aggs": {
"fail_count": {
"value_count": {
"field": "return_condition"
}
}
}
},
"pass_bucket": {
"filter": {
"term": {
"return_condition": "false"
}
},
"aggs": {
"pass_count": {
"value_count": {
"field": "return_condition"
}
}
}
},
"fail_percent": {
"bucket_script": {
"buckets_path": {
"total_fail": "fail_bucket>fail_count",
"total_pass": "pass_bucket>pass_count"
},
"script": "if(!isDefined(total_fail)) {total_fail == 0} (total_fail/(total_fail + total_pass)) * 100"
}
}
}
}
}
```
}
---
### Author:  [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)
#### Post date: [September 13, 2018, 5:02pm UTC](https://discuss.elastic.co/t/bucket-script-location/148366/3 "2018-09-13T17:02:59Z")
The solution was in the old scripting, I was using total\_fails instead of params.total\_fails. Problem solved.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 11, 2018, 5:03pm UTC](https://discuss.elastic.co/t/bucket-script-location/148366/4 "2018-10-11T17:03:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.