How to calculate EXCEPT SET from one to another?

[hiteny (Michael)]

I want to get the keys which only appears in bucket2>metric2
Here is the code :

POST testa/_search?size=0
{
  "size": 0,
  "query": {
    "term": {
      "create_date": {
        "value": "2021-12-25"
      }
    }
  },
  "aggs": {
    "bucket1": {
      "filter": {
        "bool": {
          "should": [
            {
              "range": {
                "login_date": {
                  "gte": "2021-12-26",
                  "lte": "2021-12-27"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "metric1": {
          "terms": {
            "field": "session_id",
            "size": 900
          }
        }
      }
    },
    "bucket2": {
      "filter": {
        "bool": {
          "should": [
            {
              "range": {
                "login_date": {
                  "gte": "2021-12-27",
                  "lte": "2021-12-28"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "metric2": {
          "terms": {
            "field": "session_id",
            "size": 900
          }
        }
      }
    }
  }
}

Any suggestions would be welcome
Regards

[hiteny (Michael)]

Test data:

#test data:
POST /testa/_bulk?refresh
{"index":{}}
{"session_id":1,"create_date":"2021-12-25","login_date":"2021-12-25"}
{"index":{}}
{"session_id":2,"create_date":"2021-12-25","login_date":"2021-12-25"}
{"index":{}}
{"session_id":3,"create_date":"2021-12-25","login_date":"2021-12-25"}
{"index":{}}
{"session_id":4,"create_date":"2021-12-25","login_date":"2021-12-25"}
{"index":{}}
{"session_id":5,"create_date":"2021-12-25","login_date":"2021-12-25"}


##day 2
POST /testa/_bulk?refresh
{"index":{}}
{"session_id":1,"create_date":"2021-12-25","login_date":"2021-12-25"}
{"index":{}}
{"session_id":3,"create_date":"2021-12-25","login_date":"2021-12-26"}
{"index":{}}
{"session_id":4,"create_date":"2021-12-25","login_date":"2021-12-26"}
{"index":{}}
{"session_id":6,"create_date":"2021-12-26","login_date":"2021-12-26"}

##day 2
POST /testa/_bulk?refresh
{"index":{}}
{"session_id":2,"create_date":"2021-12-25","login_date":"2021-12-27"}
{"index":{}}
{"session_id":3,"create_date":"2021-12-25","login_date":"2021-12-27"}
{"index":{}}
{"session_id":7,"create_date":"2021-12-27","login_date":"2021-12-27"}

[Tomo_M (Tomohiro Mitani)]

Hi, @hiteny

How about using bucket selector aggregation, which is a pipeline aggregation?

{
  "size":0,
  "query":{
    "bool":{
      "must":[{
        "range":{
          "login_date":{
            "gte": "2021-12-26",
            "lte": "2021-12-28"
          }
        }
      },{
        "term":{
          "create_date": {
            "value": "2021-12-25"
          }
        }
      }]
    }
  },
  "aggs":{
    "id":{
      "terms":{
        "field": "session_id",
        "size": 10000
      },
      "aggs":{
        "day1":{
          "filter": {
            "range":{
              "login_date":{
                "gte": "2021-12-26",
                "lte": "2021-12-27"
              }
            }
          }
        },
        "day2":{
          "filter": {
            "range":{
              "login_date":{
                "gte": "2021-12-27",
                "lte": "2021-12-28"
              }
            }
          }
        },
        "day_filter":{
          "bucket_selector": {
            "buckets_path": {
              "day1_count": "day1._count",
              "day2_count": "day2._count"
            },
            "script": "(params.day1_count>0)&&(params.day2_count==0)"
          }
        }
      }
    }
  }
}

{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 4,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "id" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : 4,
          "doc_count" : 1,
          "day2" : {
            "doc_count" : 0
          },
          "day1" : {
            "doc_count" : 1
          }
        }
      ]
    }
  }
}