I am trying to count documents over a week, for each hour/day of the week. So essentially, I'd like the output to be 7x24 =168 doc_counts, for a specified date range.
The code below nearly gives me what I need, however, it only returns the top terms when I need all of them.
{"size": 0,
"aggs" : {
"booked_filter" : {
"filter" : { "term": {"type":"booked"} },
"aggs": {
"range": {
"date_range": {
"field": "start",
"format": "date_hour_minute_second",
"ranges": [{ "to": "now", "from": "now-7d"}]},
"aggs": {
"day-of-week-count": {
"terms": {
"script": "return doc[\"start\"].value.getDayOfWeekEnum();"},
"aggs": {
"hour-of_day-count": {
"terms": {
"script": "return doc[\"start\"].value.getHourOfDay();"
}
}
}
}
}
}
}
}
}
}
The documentation says that instead of just setting the size greater than the cardinality of the field, I should use a composite aggregation. This is what I've tried:
{"size": 0,
"aggs" : {
"booked_filter" : {
"filter" : { "term": {"type":"booked"} },
"aggs": {
"date-filter": {
"filter": {
"range": {
"startu": {
"gte": 1583440081000,
"lte": 1584131281000}}}},
"aggs": {
"composite": {
"sources": [
{"day-of-week-count": { "terms": {"script": "return doc[\"start\"].value.getDayOfWeekEnum();"}}},
{"hour-count": {"terms": {"script": "return doc[\"start\"].value.getHourOfDay();"}}}]
}
}
}
}
}
}
However, this gives me the following error:
`"[composite] aggregation cannot be used with a parent aggregation of type: [FilterAggregatorFactory]"
Am I approaching this entirely incorrectly? Or is this something Elasticsearch isn't able to do at the moment?
Adjusting the size of the first query should give me the info I need, but I'd like to know the proper way to handle a use case like this if there is one.