HI,
I have the below query, however in the buckets_path for "var2" I am getting the ""No aggregation found for path" error.
Query
GET snmp-*/_search
{
"_source": false,
"query": {
"range": {
"timestamp": {
"gte": "now-90m/m",
"lte": "now"
}
}
},
"size": 0,
"aggs": {
"all_matching_docs": {
"filters": {
"filters": {
"all": {
"match_all": {}
}
}
},
"aggs": {
"baselineCmtsCount": {
"cardinality": {
"field": "cmtsId"
}
},
"every45min": {
"date_histogram": {
"field": "timestamp",
"fixed_interval": "45m",
"order": {
"_key": "asc"
}
},
"aggs": {
"cmtsPer45min": {
"cardinality": {
"field": "cmtsId"
}
}
}
},
"cmtsDerivative": {
"bucket_script": {
"buckets_path": {
"var1": "baselineCmtsCount.value",
"var2": "every45min.buckets.1.cmtsPer45min.value"
},
"script": "params.var1 - params.var2"
}
}
}
}
}
}
Error
{
"type": "illegal_argument_exception",
"reason": "No aggregation found for path [every45min.buckets.1.cmtsPer45min.value]"
},
I am trying to parse the value from "every45min.buckets.1.cmtsPer45min.value" in my var2 to perform a difference with var1 (i.e var1 - var2)
Any help on what is wrong please ?