# Help with date\_histogram aggs over field by field

**URL:** <https://discuss.elastic.co/t/help-with-date-histogram-aggs-over-field-by-field/99766>\
**Category:** Elasticsearch\
**Created:** [September 7, 2017, 8:25pm UTC](https://discuss.elastic.co/t/help-with-date-histogram-aggs-over-field-by-field/99766 "2017-09-07T20:25:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tarp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tarp/32/51884_2.png) [@tarp](https://discuss.elastic.co/u/tarp)\
**Post date:** [September 7, 2017, 8:25pm UTC](https://discuss.elastic.co/t/help-with-date-histogram-aggs-over-field-by-field/99766/1 "2017-09-07T20:25:05Z")

</div>

Hi,

I'm trying to create an aggregate of an index that contains queueing metrics. Each document will contain, the queue name, enqueue rate, dequeue rate and some other values.

I created an aggregate query for the enqueue rate  
POST /logstash-activemq-2017.07.31/\_search?size=0  
{  
"aggs" : {  
"aggs\_60m" : {  
"date\_histogram": {  
"field": "@timestamp",  
"interval": "60m"  
},  
"aggs" : {  
"enqueue\_rate" : {  
"stats" : { "field": "enqueue" }  
}  
}  
}  
}  
}

This aggregates all queues together and not per queue. What I would like to is to create an aggregate that is.  
60 minute stats of Enqueue Rate by Queue.

I'm at a loss on how to nest the, By Queue, into my query.  
Thanks for the help,  
Tim

---

<div class="post-metadata">

**Author:** ![abdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdon/32/9195_2.png) [@abdon](https://discuss.elastic.co/u/abdon)\
**Post date:** [September 8, 2017, 1:34pm UTC](https://discuss.elastic.co/t/help-with-date-histogram-aggs-over-field-by-field/99766/2 "2017-09-08T13:34:30Z")

</div>

Nest your `date_histogram` aggregation inside a `terms` aggregation on the queue name field. For example, if that field is called `name`, this request should give you what you want:

```
POST /logstash-activemq-2017.07.31/_search?size=0
{
  "aggs": {
    "queue": {
      "terms": {
        "field": "name",
        "size": 100
      }, 
      "aggs": {
        "aggs_60m": {
          "date_histogram": {
            "field": "@timestamp",
            "interval": "60m"
          },
          "aggs": {
            "enqueue_rate": {
              "stats": {
                "field": "enqueue"
              }
            }
          }
        }
      }
    }
  }
}

```

This will guve you a date histogram per queue.

Some things to be aware of here:

- the `name` field needs to be mapped as type `keyword`. If you haven't explicitly mapped your fields, you should have a `.keyword` multi-field that you could use like this: `"field": "name.keyword"`
- because of the `"size": 100` you will only get the 100 most common queues (the queues for which there are the most documents). You can change the `size` parameter if you want to see more or less queues.
- the queues will be ranked by popularity (how common they are - based on the `doc_count`). If you want, you can [order the results differently](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-order).

---

<div class="post-metadata">

**Author:** ![tarp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tarp/32/51884_2.png) [@tarp](https://discuss.elastic.co/u/tarp)\
**Post date:** [September 11, 2017, 3:53pm UTC](https://discuss.elastic.co/t/help-with-date-histogram-aggs-over-field-by-field/99766/3 "2017-09-11T15:53:33Z")

</div>

> [@abdon](#):
>
> POST /logstash-activemq-2017.07.31/\_search?size=0  
> {  
> "aggs": {  
> "queue": {  
> "terms": {  
> "field": "name",  
> "size": 100  
> },  
> "aggs": {  
> "aggs\_60m": {  
> "date\_histogram": {  
> "field": "@timestamp",  
> "interval": "60m"  
> },  
> "aggs": {  
> "enqueue\_rate": {  
> "stats": {  
> "field": "enqueue"  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> }

Thanks that helps.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2017, 3:53pm UTC](https://discuss.elastic.co/t/help-with-date-histogram-aggs-over-field-by-field/99766/4 "2017-10-09T15:53:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.