Filter Data According to TImeStamp Difference

Elastic Stack Elasticsearch
1

I am trying to apply a script to grab the difference between two records with this format
{
"_index": "test",
"_type": "test",
"_id": "AWAwn3lqptselg3AANJ3",
"_score": 3.0308797,
"_source": {
"timestamp": 1512385591,
"plugin_output": {
"color": "green",
},
"input_source": "5a2530041673ce1e26dd8595"
}
},
{
"_index": "test",
"_type": "test",
"_id": "AWAwn3luptselg3AANKT",
"_score": 3.0308797,
"_source": {
"user_id": "ict",
"timestamp": 1512385931,
"plugin_output": {
"color": "red"
}
}

where I want to apply the time as filter for the same query to fetch all the records that match the difference between Red - Green is it possible from one query to do so Or not && Why ?

2

Is there a common entity key (eg deviceID) that is required to join these 2 event docs?
Do you need to do this for just one event pair or repeat the calculation for many pairs?
Do you have multiple shards in which case the related data may be held on different machines?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.