# Calculate P95 with Transforms

**URL:** <https://discuss.elastic.co/t/calculate-p95-with-transforms/249018>\
**Category:** Elasticsearch\
**Tags:** transforms\
**Created:** [September 17, 2020, 5:53pm UTC](https://discuss.elastic.co/t/calculate-p95-with-transforms/249018 "2020-09-17T17:53:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohsin106](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohsin106/32/65203_2.png) [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Post date:** [September 17, 2020, 5:53pm UTC](https://discuss.elastic.co/t/calculate-p95-with-transforms/249018/1 "2020-09-17T17:53:02Z")

</div>

Hi, I'm currently storing time-series data in my ES cluster and would like to understand how I can calculate the daily P95 values for two fields (traffic.in , traffic.out) and store the result in a separate index. I have months worth of **traffic\_in** and **traffic\_out** data stored on 1-minute intervals and I want to go back in time and generate the P95 per day stats for these two fields. Is this possible to accomplish?

I tried using Transforms but for some reason, the date in the @timestamp field in the results was all the same. Every record in the result had this date in the @timestamp field (Sep 15, 2020 @ 20:00:00.000).

I was hoping to use Transforms to run a query every day to calculate the P95 values for the previous day's worth of data and store this info into a separate index. This new index would update every day when the Transform runs.

I configured the Transform like this:

```auto
{
  "id": "transforms_p95_v2",
  "source": {
    "index": [
      "transforms-v3"
    ],
    "query": {
      "match_all": {}
    }
  },
  "dest": {
    "index": "transforms_p95_v2"
  },
  "sync": {
    "time": {
      "field": "@timestamp",
      "delay": "86400s"
    }
  },
  "pivot": {
    "group_by": {
      "@timestamp": {
        "date_histogram": {
          "field": "@timestamp",
          "calendar_interval": "1d"
        }
      },
      "a_node": {
        "terms": {
          "field": "a_node"
        }
      },
      "z_node": {
        "terms": {
          "field": "z_node"
        }
      },
      "bundle": {
        "terms": {
          "field": "bundle"
        }
      },
      "site": {
        "terms": {
          "field": "site"
        }
      }
    },
    "aggregations": {
      "traffic.in": {
        "percentiles": {
          "field": "traffic.in",
          "percents": [
            95
          ]
        }
      },
      "traffic.out": {
        "percentiles": {
          "field": "traffic.out",
          "percents": [
            95
          ]
        }
      }
    }
  }

```

Thank you.

---

<div class="post-metadata">

**Author:** ![mohsin106](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohsin106/32/65203_2.png) [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Post date:** [September 18, 2020, 5:45pm UTC](https://discuss.elastic.co/t/calculate-p95-with-transforms/249018/2 "2020-09-18T17:45:54Z")

</div>

I think I may have found my answer. The Sept 15, 2020 timestamp is the UTC to EDT converted timestamp for each day. So 24:00 UDT equals 20:00 EDT.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2020, 5:45pm UTC](https://discuss.elastic.co/t/calculate-p95-with-transforms/249018/3 "2020-10-16T17:45:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.