During exam preparation I run across the following:
I wanted to see requests per country:
GET logs_server*/_search
{
"size": 0,
"aggs": {
"top_countries": {
"terms": {
"field": "geoip.country_name.keyword",
"size": 400
}
}
}
}
which worked as expected.
And now I want to get/calculate the percentages per country so I tried:
GET logs_server*/_search
{
"size": 0,
"aggs": {
"top_countries": {
"significant_terms": {
"field": "geoip.country_name.keyword",
"percentage": {},
"size": 400
}
}
}
}
Gets me all the numbers but does not calculate percentages. Next try:
GET logs_server*/_search
{
"size": 0,
"aggs": {
"all_countries": {
"value_count": {
"field": "geoip.country_name.keyword"
}
},
"by_countries": {
"terms": {
"field": "geoip.country_name.keyword",
"size": 400
},
"aggs": {
"percentage": {
"bucket_script": {
"buckets_path": {
"all": "all_countries",
"country": "by_countries"
},
"script": "country /all * 100"
}
}
}
}
}
}
Produces:
"reason" : "No aggregation found for path [all_countries]"
So, how could I calculate the requests (doc_count) percentage per country?