# How to bucket aggregate on document without any numeric field

**URL:** <https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375>\
**Category:** Kibana\
**Created:** [February 16, 2022, 2:01pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375 "2022-02-16T14:01:00Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![pandu](https://avatars.discourse-cdn.com/v4/letter/p/8491ac/32.png) [@pandu](https://discuss.elastic.co/u/pandu)\
**Post date:** [February 16, 2022, 2:01pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/1 "2022-02-16T14:01:00Z")

</div>

I have an index that has documents representing calls. Every document is a call. I want to report average calls per day from every customer. The information needs to be bucketed by week. How do I do that? There is no numeric field as call number. Count of documents is the call

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 16, 2022, 2:56pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/2 "2022-02-16T14:56:55Z")

</div>

Use [terms aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) and [date histogram aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-datehistogram-aggregation.html).  
Doc counts for each buckets will be returned.

---

<div class="post-metadata">

**Author:** ![pandu](https://avatars.discourse-cdn.com/v4/letter/p/8491ac/32.png) [@pandu](https://discuss.elastic.co/u/pandu)\
**Post date:** [February 16, 2022, 5:40pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/3 "2022-02-16T17:40:13Z")

</div>

I want the max and min also per bucket.

---

<div class="post-metadata">

**Author:** ![pandu](https://avatars.discourse-cdn.com/v4/letter/p/8491ac/32.png) [@pandu](https://discuss.elastic.co/u/pandu)\
**Post date:** [February 16, 2022, 6:28pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/4 "2022-02-16T18:28:35Z")

</div>

For example: Every bucket has 7 days worth of documents. I want to show Max and MIN docs per day in a week. THus, if there are 10,12,11,15,16,20,22 docs on Monday-Sunday, 10 will be MIN, 22 will be MAX, and Avg will be (10+12+11+15+16+20+22)/7

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 20, 2022, 10:55am UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/5 "2022-02-20T10:55:19Z")

</div>

```auto
GET /kibana_sample_data_logs/_search
{
  "size":0,
  "aggs": {
    "week": {
      "date_histogram": {
        "field": "timestamp", 
        "interval": "week"
      },
      "aggs":{
        "day":{
          "date_histogram": {
            "field": "timestamp",
            "interval": "day",
            "min_doc_count": 0
          }
        },
        "min":{
          "min_bucket": {
            "buckets_path": "day._count"
          }
        },
        "max":{
          "max_bucket": {
            "buckets_path": "day._count"
          }
        },
        "avg":{
          "avg_bucket": {
            "buckets_path": "day._count"
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![pandu](https://avatars.discourse-cdn.com/v4/letter/p/8491ac/32.png) [@pandu](https://discuss.elastic.co/u/pandu)\
**Post date:** [February 20, 2022, 11:58am UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/6 "2022-02-20T11:58:43Z")

</div>

How do I feed this to a visual?

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 20, 2022, 12:05pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/7 "2022-02-20T12:05:47Z")

</div>

Maybe you need `Custom visualisation` using `vega` or `vega-lite`.

---

<div class="post-metadata">

**Author:** ![pandu](https://avatars.discourse-cdn.com/v4/letter/p/8491ac/32.png) [@pandu](https://discuss.elastic.co/u/pandu)\
**Post date:** [February 20, 2022, 12:18pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/8 "2022-02-20T12:18:45Z")

</div>

Couldn’t I create a new index using your script?

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 20, 2022, 12:24pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/9 "2022-02-20T12:24:22Z")

</div>

Why you want to create a new index?

---

<div class="post-metadata">

**Author:** ![pandu](https://avatars.discourse-cdn.com/v4/letter/p/8491ac/32.png) [@pandu](https://discuss.elastic.co/u/pandu)\
**Post date:** [February 20, 2022, 2:05pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/10 "2022-02-20T14:05:12Z")

</div>

Thanks for responding. New to ELK. Here is my situation: I have documents representing calls made. Each document is a call. I need to group them by weekly by customers , and show average (per week), max etc. using the visualization (data table) didn’t help as I could group index by week and customer. But the metric it showed is total count (over the week). So I created a bucket aggregation using GET method. It shows the aggregated data. My question is how do I use this data in visualization? Do I need to create an aggregated index using GET method OR there is a way to use this GET method script directly in visualization? Something like Sql pass through.

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 20, 2022, 2:15pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/11 "2022-02-20T14:15:19Z")

</div>

To create an aggregated index, [transform](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html) is the function.

As there is no out-of-the-box visualization to support two staged aggregation (daily -\> weekly), maybe creating pivot transform groupby daily date histogram and then visualise that index as you like is the shortest way.

---

<div class="post-metadata">

**Author:** ![pandu](https://avatars.discourse-cdn.com/v4/letter/p/8491ac/32.png) [@pandu](https://discuss.elastic.co/u/pandu)\
**Post date:** [February 20, 2022, 2:41pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/12 "2022-02-20T14:41:02Z")

</div>

What is use of GET method? Just to view data? Can’t be used to create visuals off?

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 20, 2022, 2:48pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/13 "2022-02-20T14:48:49Z")

</div>

Dev Tools is a tool for developing Elasticsearch query DSL.  
Most visualisations create there own DSL query and can not use your customized query. The only way is use `Custom visualisation` using `vega` or `vega-lite`.

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 20, 2022, 2:49pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/14 "2022-02-20T14:49:17Z")

</div>

Please see all the links I made earlier.

---

<div class="post-metadata">

**Author:** ![pandu](https://avatars.discourse-cdn.com/v4/letter/p/8491ac/32.png) [@pandu](https://discuss.elastic.co/u/pandu)\
**Post date:** [February 20, 2022, 4:56pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/15 "2022-02-20T16:56:30Z")

</div>

What is the purpose of Dev tools then? More like query tool to view data, but not usable to feed the results to a dashboard?

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 20, 2022, 5:11pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/16 "2022-02-20T17:11:47Z")

</div>

In fact, any requests for Elasticsearch cluster could be executed via Dev tools: cluster API, transform API, reindex API...etc. It is a combinient tool to manage Elasticsearch (not kibana). And of course it could be used to develop query for `custom visualisation`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2022, 5:12pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375/17 "2022-03-20T17:12:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
