Daily average over terms: how to handle "missing" terms

My logs contain information about machines and their production. Now I wish to know the average amount produced per day. I think I'd to that like this:

{
  "size": 0,
  "aggs": {
    "per_day": {
      "date_histogram": {
    	"field": "startTime",
    	"calendar_interval": "day"
      },
      "aggs": {
      	"daily_amounts": {
      		"terms": {
      			"field": "machine.keyword"
      		},
      		"aggs": {
      			"total_amount": {
          			"sum": {
          				"field": "amount"
          			}
      			}
      		}
      	},
      	"daily_avg": {
      		"avg_bucket": {
      			"buckets_path": "daily_amounts>total_amount"
      		}
      	}
      }
    }
  }
}

I know there are, say, six machines. But if one of those doesn't produce anything in one day, I don't have log entries for that and thus the machine doesn't appear in the terms agg.
How can I handle this?

I tried using a bucket script aggregation like so:

{
  "size": 0,
  "aggs": {
    "per_day": {
      "date_histogram": {
    	"field": "startTime",
    	"calendar_interval": "day"
      },
      "aggs": {
      	"daily_amounts": {
      		"terms": {
      			"field": "machine.keyword"
      		},
      		"aggs": {
      			"total_amount": {
          			"sum": {
          				"field": "amount"
          			}
      			}
      		}
      	},
      	"daily_avg": {
      		"bucket_script": {
      			"buckets_path": { "foo": "daily_amounts>total_amount" },
      			"script": "params.foo / 6.0"
      		}
      	}
      }
    }
  }
}

But this complains about buckets_path must reference either a number value or a single value numeric metric aggregation, got: [Object[]] at aggregation [daily_amounts].
Any help is greatly appreciated.

I found a way to do this by using a sum bucket aggregation for the total_amount and then dividing by the total number of machines via bucket_script. It seems clumsy to me though.

I'd love to hear about possible easier ways.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.