Date Histogram based on aggregate total values

Elastic Stack Elasticsearch
1

Hello,

I have an index that contains documents such as the follow:

{
  "event" : "pageView",
  "owner" : "5dbec3a4-55bf-4c83-912e-6ddb56623bc4",
  "session" : "c17b4d6c-dfea-4ecb-8c6f-7401f8f8595a",
  "createdAt" : "2019-07-15T17:03:34Z"
}

I am looking to group information by each unique session UUID and after that group them into a Date Histogram per 24h.

The following query does seem to retrieve what I am looking:

GET events/_search?size=0&filter_path=aggregations.sessions_over_time.buckets
{
  "query": {
    "bool": {
      "filter": [{
        "term": {
          "owner.keyword": "5dbec3a4-55bf-4c83-912e-6ddb56623bc4"
        }
      }]
    }
  },
  "aggs": {
    "sessions_over_time": {
      "date_histogram": {
        "field": "createdAt",
          "interval": "24h",
          "format": "yyyy-MM-dd"
      },
      "aggs": {
        "unique_sessions": {
          "terms": {
            "field": "session.keyword"
          }
        },
        "total_sessions": {
          "sum_bucket": {
            "buckets_path": "unique_sessions>_count"
          }
        }
      }
    }
  }
}

However:

  1. How can I retrieve only the date intervals from histogram+total_sessions and not the unique sessions in the answer? Of course I need unique_sessions to be present to be able to calculate the total_sessions, but I don't need it at all in the response.

  2. I should specify a size in the unique_sessions term agg othersize a default size of 10 will be used and will limit the veracity of the data, is that right? I have read that composite aggregation might help on this case as it gets the entire data being able to scroll efficiently. How could I use such agg here?

Thanks!

EDIT:

  1. Meanwhile, I figured it out I could just use this filter_path and that would cleanup a lot of the response for me:

    GET analytics/_search?size=0&filter_path=aggregations.sessions_over_time.buckets.key_as_string,aggregations.sessions_over_time.buckets.total_sessions

If there is any other neat way to do it that would involve less processing somehow, let me know.

The 2) point still needs some clarification however.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.