Elasticsearch sub agregation

With the following query, I get the minimum value in each chunk of 15 minutes. I use the moving_fn function. Now I need to get the maximum value in each chunk in 1 hour from the previous request. As I understand it cannot be used for aggregation after moving_fn. How can you do this?

This is my query:

GET logstash-2021.12.2*/_search 
{ 
  "query": { 
    "bool": { 
      "filter": [ 
        { 
          "range": { 
            "@timestamp": { 
              "gte": "now-24h" 
            } 
          } 
        }, 
        { 
          "bool": { 
            "should": [ 
              { 
                "match_phrase": { 
                  "company": "BLAH-BLAH" 
                } 
              }
            ] 
          } 
        } 
      ] 
    } 
  },
  "size": 0,
  "aggs": {
    "myDatehistogram": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1m",
        "offset": "+30s"
      }, "aggs": {
        "the_count": {
          "moving_fn": {
            "buckets_path": "_count",
            "window": 15,
            "script": "MovingFunctions.min(values)"
          }
        }
      }
    }
   }
}

My response:

"aggregations" : {
    "myDatehistogram" : {
      "buckets" : [
        {
          "key_as_string" : "2021-12-25T05:58:30.000Z",
          "key" : 1640411910000,
          "doc_count" : 1196,
          "the_count" : {
            "value" : null
          }
        },
        {
          "key_as_string" : "2021-12-25T05:59:30.000Z",
          "key" : 1640411970000,
          "doc_count" : 1942,
          "the_count" : {
            "value" : 1196.0
          }
        },
        {
          "key_as_string" : "2021-12-25T06:00:30.000Z",
          "key" : 1640412030000,
          "doc_count" : 1802,
          "the_count" : {
            "value" : 1196.0
          }
        },
        {
          "key_as_string" : "2021-12-25T06:01:30.000Z",
          "key" : 1640412090000,
          "doc_count" : 1735,
          "the_count" : {
            "value" : 1196.0
          }
        },
        {
          "key_as_string" : "2021-12-25T06:02:30.000Z",
          "key" : 1640412150000,
          "doc_count" : 1699,
          "the_count" : {
            "value" : 1196.0
          }
        },
        {
          "key_as_string" : "2021-12-25T06:03:30.000Z",
          "key" : 1640412210000,
          "doc_count" : 1506,
          "the_count" : {
            "value" : 1196.0
          }
        }

From this answer, I need to get the maximum value for each hour. Thank you in advance

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.