Diff of 2 terms aggregations

Elastic Stack Kibana
, ,
1

Hello,

I want to create 2 terms aggregations :

"allUsers"			: {"terms": {"field": "User"}}
"allPresentUsers"	: {"terms": {"field": "PresentUser"}}

=> Then, I want to find the absent users.

So, I want to create a third aggregation which lists the users from "allUsers" who are not in "allPresentUsers".

Do you know how I can do this with Elasticsearch ?
Are there different ways to approach the problem ?

Thank you for your help,

Florent

2

You will need to create this data on your own by running those queries, and post-processing the results using a script. You can take the post-processed data and index it into a new ES index, which will allow you to analyze how you want.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.