# Creating new index from aggregation

**URL:** <https://discuss.elastic.co/t/creating-new-index-from-aggregation/221275>\
**Category:** Elasticsearch\
**Created:** [February 27, 2020, 4:08pm UTC](https://discuss.elastic.co/t/creating-new-index-from-aggregation/221275 "2020-02-27T16:08:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mistrhanky](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@mistrhanky](https://discuss.elastic.co/u/mistrhanky)\
**Post date:** [February 27, 2020, 4:08pm UTC](https://discuss.elastic.co/t/creating-new-index-from-aggregation/221275/1 "2020-02-27T16:08:30Z")

</div>

Here is my issue: I have to produce visualizations for some extended reporting. For brevity I will simply tell you I end up with events that look like they do below. The key thing is that I have multiple events per day with the same simple data stamp and growing byte counts. The byte counts are the max at various times during the day, so in the end I need the max of the field, not the sum of the bytes field.

In the end, I get data that looks like:  
bizunit: finance simple\_date: 2020-02-01 bytes: 1234  
bizunit: sales simple\_date: 2020-02-01 bytes: 1234  
bizunit: finance simple\_date: 2020-02-01 bytes: 1934  
bizunit: sales simple\_date: 2020-02-01 bytes: 19034  
bizunit: finance simple\_date: 2020-02-01 bytes: 2234  
bizunit: sales simple\_date: 2020-02-01 bytes: 20345  
bizunit: finance simple\_date: 2020-02-01 bytes: 4234  
bizunit: sales simple\_date: 2020-02-01 bytes: 569834

What I need to do is to be able to show things like how many bytes each bizunit consumed per day, month, etc? I have tried doing an aggregation which will show the results, but the catch is that i need to get this to a place that kibana can visualize and their are no kibana options for summarizing a max per day and using that max to sum up over weeks or months. If I use sum, it will only sum all of the numbers in the field, not take the max. If I use max, it will give the largest number a bizunit or a day had for the month, but not each day+each bizunit, if that makes sense.

So, a very long story short, I need to be able to either put in an aggregation query which buckets all of this correctly and have kibana visualizations be able to read it and graph it, OR I need to be able to reindex my data in such a way as I only get one event per day that has a max bytes field, data and bizunit. That way, kibana could just sum it all.

I can add my aggregation that buckets if that helps, but I don't think that is really the issue. I have attempted \_reindex, but that does not seem to handle the aggregation fields, it just transfers all the previous events to the new one. Can anyone help?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2020, 4:08pm UTC](https://discuss.elastic.co/t/creating-new-index-from-aggregation/221275/2 "2020-03-26T16:08:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.