Hello,
I have this query
GET /my_index3/_search
{
"size": 0,
"aggs": {
"num1": {
"terms": {
"field": "num1.keyword",
"order": {
"_count": "desc"
}
},
"aggs": {
"count_of_suffix": {
"cardinality": {
"field": "suffix.keyword"
}
},
"my_filter": {
"bucket_selector": {
"buckets_path": {
"count_of_suffix": "count_of_suffix"
},
"script": "params.count_of_suffix == 2"
}
}
}
}
}
}
With output
"aggregations" : {
"num1" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "1563866656876839",
"doc_count" : 106,
"count_of_suffix" : {
"value" : 2
}
},
{
"key" : "1563867854324841",
"doc_count" : 50,
"count_of_suffix" : {
"value" : 2
}
},
{
"key" : "1563866656878888",
"doc_count" : 42,
"count_of_suffix" : {
"value" : 2
}
},
{
"key" : "1563866656871111",
"doc_count" : 40,
"count_of_suffix" : {
"value" : 2
}
So it shows me numbers that have both suffix.
The thing what I need is somehow set up the range query for occured cardinality. I mean that num1 has only 1 suffix and if the same num1 didn't get second suffix within some time e.g one hour it wouldn't show this bucket even if the count_of_suffix == 2.
Thank you for any help!!!