# Can/should percolator be set up to return when an aggregation value hits a certain threshold?

**URL:** <https://discuss.elastic.co/t/can-should-percolator-be-set-up-to-return-when-an-aggregation-value-hits-a-certain-threshold/61308>\
**Category:** Elasticsearch\
**Created:** [September 22, 2016, 8:08pm UTC](https://discuss.elastic.co/t/can-should-percolator-be-set-up-to-return-when-an-aggregation-value-hits-a-certain-threshold/61308 "2016-09-22T20:08:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisjames](https://avatars.discourse-cdn.com/v4/letter/c/c77e96/32.png) [@chrisjames](https://discuss.elastic.co/u/chrisjames)\
**Post date:** [September 22, 2016, 8:08pm UTC](https://discuss.elastic.co/t/can-should-percolator-be-set-up-to-return-when-an-aggregation-value-hits-a-certain-threshold/61308/1 "2016-09-22T20:08:30Z")

</div>

Take the following aggregation query as an example:

```
{
  "query": {
    "match_all": {}
  },
  "aggs": {
    "groupBy": {
      "terms": {
        "field": "CustomerName"
      },
      "aggs": {
        "points_sum": {
          "stats": {
            "field": "TransactionAmount"
          }
        }
      }
    }
  },
  "size": 0
}

```

I am interested in knowing when any CustomerName has an average TransactionAmount (stats.avg) that is above some threshold for all of that customer's purchases, as soon as I index a document that would put my average above that threshold. It seems like percolator is designed for matching documents to rules, more or less, but I can't find any good examples of using percolator to match rules that are based on aggregation results.

Is this possible? Is percolator the best solution here? Is there another/better solution? Thanks in advance 🙂

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [September 26, 2016, 12:29pm UTC](https://discuss.elastic.co/t/can-should-percolator-be-set-up-to-return-when-an-aggregation-value-hits-a-certain-threshold/61308/2 "2016-09-26T12:29:22Z")

</div>

Percolator queries are designed to test properties of a single document.  
Your example is testing properties of a new document but with respect to some previous history.

One option is to use Watcher to poll your index looking for these anomalies - see [1]  
If your logic is complex it may also be worth considering creating an entity-centric index to represent each customer and use a script to re-assess the risk attached to a new transaction in respect of their historic behaviour.

Cheers  
Mark

[1] [https://www.elastic.co/blog/when-and-how-to-percolate-1](https://www.elastic.co/blog/when-and-how-to-percolate-1)  
[2] [https://www.youtube.com/watch?v=yBf7oeJKH2Y](https://www.youtube.com/watch?v=yBf7oeJKH2Y)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:17pm UTC](https://discuss.elastic.co/t/can-should-percolator-be-set-up-to-return-when-an-aggregation-value-hits-a-certain-threshold/61308/3 "2017-07-05T22:17:20Z")

</div>