How set default values with fields in Aggregation results' empty buckets?

Elastic Stack Elasticsearch
2

i solved.

the problem was 'terms' aggregation.

'terms' aggregation returning buckets.

in this case, 'ccr.count' is integer and there is only 1 docs. (it can be not exist)

so i changed config 'terms' to 'avg' like this.

"aggs": {
                "times": {
                  "date_histogram": {
                    "field": "ccr.key",
                    "interval": "minute",  
                    "format": "yyyyMMdd:HHmm"
                  },
                  "aggs": {
                    "count" : {
                      "avg": { // here
                        "field": "ccr.count"
                      }
                    }
                  }
                },...
              }

then, result will not be buckets. it return 'value' property.

if there isn't exist, returned 'null' value instead of 'empty buckets' like this.

"times": {
            "buckets": [
              {
                "key_as_string": "20190116:0000",
                "key": 1547596800000,
                "doc_count": 1,
                "count": {
                  "value": 156 // when exist
                }
              },{
                "key_as_string": "20190116:0001",
                "key": 1547596860000,
                "doc_count": 0,
                "count": {
                  "value": null // when doesn't exist
                }
              },...]
}

in kibana or vega graph, 'null' and '0' are same value in the graph's Y-Axis.

following is comparison of them.
caution : following graphs are showing difference values. not same.

(when using 'terms' aggregation)

terms
terms.jpg2615×506 137 KB

in 00:00 ~ 10:00 , i cant know values are '0' exactly.
it is confusing because look like 'increased steadily'.

(when using 'avg' aggregation)

avg
avg.jpg2615×502 130 KB

in 00:00 ~ 10:00,
i know that there values are '0' exactly

1 Like