Difficulties to make a request with elasticsearch

Hello,
I encounter difficulties to make the request i would like.
You will probably need the mapping of my index to understand what i want to do :

{
 "camtest": {
     "aliases": {},
     "mappings": {
       "properties": {
          "MB_peer": {
            "type": "long"
          },
          "MB_server": {
            "type": "float"
          },
         "client_uuid": {
            "type": "text", 
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
               }
             }
         },
        "glitches": {
            "type": "long"
        },
       "new_client_uuid": {
           "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
           }
       },
       "qualities": {
           "properties": {
                  "quality1": {
                        "type": "long"
                   },
                  "quality2": {
                        "type": "float"
                  }
            }
            },
     "represented_client": {
            "type": "long"
       },
      "sec_peer": {
            "type": "long"
       },
      "sec_rebuf": {
            "type": "long"
       },
      "sec_server": {
            "type": "float"
       },
      "timestamp": {
              "type": "date"
      }, 
      "video_id": {
             "type": "text",
             "fields": {
               "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
              }
           }
       }
    }
},
"settings": {
"index": {
"creation_date": "1564589364792",
"number_of_shards": "1",
"number_of_replicas": "1",
"uuid": "oE2AJvYTRViI7hHkM-N78A",
"version": {
"created": "7020099"
},
"provided_name": "camtest"
}
}
}
}

Those data are added in elasticsearch by a dash video player. Every time someone watch the video data are added in elasticsearch "camtest" index. My question is : is it possible to make a request which will enable me to do the Average of sec_peer+sec_server for each different client_uuid. You have it is possible to have several _docs with the same client_uuid.

I succeed to do something but it isn't optimized:
In a first step i get every different client_uuid with this request :

{
"query": {
	"bool": {
			"must":[{
					"exists": { "field": "new_client_uuid"}
			}]
    },
"size" :10000
}

and in a second time for each client_uuid I do this request :

{
"query": {
	"bool": {
		"must": [
			{
				"bool": {
					"should": [
						{
							"match": {
								"client_uuid": "2c692837-272a-4b64-aca0-94fca91c23b8"
							}
						},
						{
							"match": {
								"new_client_uuid": "2c692837-272a-4b64-aca0-94fca91c23b8"
							}
						}
					],
					"minimum_should_match": 1
				}
			}
			]
                   }
           }, 
          "aggs": {
		"sum_sec_server": {
					"sum": {
						"field": "sec_server"
					}
		},
		"sum_sec_peer": {
			"sum": {
				"field": "sec_peer"
			}
		}
	}
}

And finally in my script i make the average.
However this solution needs to make a lot of requests. Do you think I could obtain the same result easier?

I haven't done this in years, but it seems like something that can be achieved via multi-level aggregations. Your first aggregation would be on client_uuid to separate the records into different buckets. Once you have these your sub aggregation would be to have a Avg aggregation to get your averages.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.