# Cardinality aggregation with set up time range
**URL:** https://discuss.elastic.co/t/cardinality-aggregation-with-set-up-time-range/193314
**Category:** Elasticsearch
**Created:** [August 1, 2019, 12:04pm UTC](https://discuss.elastic.co/t/cardinality-aggregation-with-set-up-time-range/193314 "2019-08-01T12:04:13Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Vladpov](https://discuss.elastic.co/u/Vladpov)
#### Post date: [August 1, 2019, 12:04pm UTC](https://discuss.elastic.co/t/cardinality-aggregation-with-set-up-time-range/193314/1 "2019-08-01T12:04:14Z")
Hello,
I have this query
```
GET /my_index3/_search
{
"size": 0,
"aggs": {
"num1": {
"terms": {
"field": "num1.keyword",
"order": {
"_count": "desc"
}
},
"aggs": {
"count_of_suffix": {
"cardinality": {
"field": "suffix.keyword"
}
},
"my_filter": {
"bucket_selector": {
"buckets_path": {
"count_of_suffix": "count_of_suffix"
},
"script": "params.count_of_suffix == 2"
}
}
}
}
}
}
```
With output
```
"aggregations" : {
"num1" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "1563866656876839",
"doc_count" : 106,
"count_of_suffix" : {
"value" : 2
}
},
{
"key" : "1563867854324841",
"doc_count" : 50,
"count_of_suffix" : {
"value" : 2
}
},
{
"key" : "1563866656878888",
"doc_count" : 42,
"count_of_suffix" : {
"value" : 2
}
},
{
"key" : "1563866656871111",
"doc_count" : 40,
"count_of_suffix" : {
"value" : 2
}
```
So it shows me numbers that have both suffix.
The thing what I need is somehow set up the range query for occured cardinality. I mean that num1 has only 1 suffix and if the same num1 didn't get second suffix within some time e.g one hour it wouldn't show this bucket even if the count\_of\_suffix == 2.
Thank you for any help!!!
---
### Author:  [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)
#### Post date: [August 1, 2019, 1:02pm UTC](https://discuss.elastic.co/t/cardinality-aggregation-with-set-up-time-range/193314/2 "2019-08-01T13:02:09Z")
That's an [entity-centric question](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-and-querrying/192748/2) again.
---
### Author:  [@Vladpov](https://discuss.elastic.co/u/Vladpov)
#### Post date: [August 1, 2019, 1:32pm UTC](https://discuss.elastic.co/t/cardinality-aggregation-with-set-up-time-range/193314/3 "2019-08-01T13:32:02Z")
So I cannot avoid it 😅 I'll study the topic. Thank you :))
---
### Author:  [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)
#### Post date: [August 1, 2019, 1:35pm UTC](https://discuss.elastic.co/t/cardinality-aggregation-with-set-up-time-range/193314/4 "2019-08-01T13:35:04Z")
What should help is to first understand what the problem is with doing this on an event-centric index - some queries just can't be made efficient on that type of store because they are fighting physics (network speeds, ram limitations).
---
### Author:  [@Vladpov](https://discuss.elastic.co/u/Vladpov)
#### Post date: [August 2, 2019, 9:39am UTC](https://discuss.elastic.co/t/cardinality-aggregation-with-set-up-time-range/193314/5 "2019-08-02T09:39:24Z")
In my case when I want to test entity-centric indexes approach on .txt file which is parsed by Logstash then forwarded to elasticsearch log-centric index (normal index? 😃) .
Do I understand it correctly that when I have data in some index I need to divide each log message from the index into entity-centric indexes where each log message has its own entity-centric index based on messageId ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 30, 2019, 9:39am UTC](https://discuss.elastic.co/t/cardinality-aggregation-with-set-up-time-range/193314/6 "2019-08-30T09:39:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.