How to aggregate based on another aggregation?

Hi folks,

I have a certain amount of user transactions per day. My final goal is to have the average of daily sums of transactions per week.

What I have done so far is the first step (the easy one). I created a chart which shows me sums of transactions per day which looks like so:

Now I want to achieve the second step: I want to have the average of the sums per day for each 7 days in another second chart. Do you have any hint how I can implement this ?

Thank you

Take a look at pipeline aggregations: Pipeline aggregations | Elasticsearch Guide [8.1] | Elastic

If you are using Lens in Kibana, you could probably go with a moving average in there without leaning into the details of pipeline aggs?

1 Like

Thanks for the response.

In Lense I tried to use moving avarage of sums of transactions but the results are still shown per day instead of required per week:

If I could break ti somehow in 7 days chunks. That'd be great.

Regarding pipeline aggregations I will take a look on that. I think I tried similar approach with TSVB Visualization type, but there I could not find how to break it down per week

When setting the horizontal axis, you can customize the time interval and set it to one week - would that work?

I this case the graph will show me the sum of the transactions per week. But what I need is:

  1. sums of transactions per day and
  2. The average of these sums for each 7 days

Basically I need two aggregations and I must use the output of the first one as input for the second one with different histogram interval. And I cannot find an approach to do that.

Alright, so the moving-avarage was exactly what I was looking for. I just misunderstood how the moving-average works and tried to break down the graph in weeks, but using moving-average with window 7 with daily interval it is not needed. Every day in the chart shows you the average of previous 7 days basically.


1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.