# How to calculate EXCEPT SET from one to another?

**URL:** <https://discuss.elastic.co/t/how-to-calculate-except-set-from-one-to-another/293244>\
**Category:** Elasticsearch\
**Created:** [December 31, 2021, 8:10am UTC](https://discuss.elastic.co/t/how-to-calculate-except-set-from-one-to-another/293244 "2021-12-31T08:10:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hiteny](https://avatars.discourse-cdn.com/v4/letter/h/e47774/32.png) [@hiteny](https://discuss.elastic.co/u/hiteny)\
**Post date:** [December 31, 2021, 8:10am UTC](https://discuss.elastic.co/t/how-to-calculate-except-set-from-one-to-another/293244/1 "2021-12-31T08:10:22Z")

</div>

I want to get the keys which only appears in bucket2\>metric2  
Here is the code :

```auto

POST testa/_search?size=0
{
  "size": 0,
  "query": {
    "term": {
      "create_date": {
        "value": "2021-12-25"
      }
    }
  },
  "aggs": {
    "bucket1": {
      "filter": {
        "bool": {
          "should": [
            {
              "range": {
                "login_date": {
                  "gte": "2021-12-26",
                  "lte": "2021-12-27"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "metric1": {
          "terms": {
            "field": "session_id",
            "size": 900
          }
        }
      }
    },
    "bucket2": {
      "filter": {
        "bool": {
          "should": [
            {
              "range": {
                "login_date": {
                  "gte": "2021-12-27",
                  "lte": "2021-12-28"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "metric2": {
          "terms": {
            "field": "session_id",
            "size": 900
          }
        }
      }
    }
  }
}

```

Any suggestions would be welcome  
Regards

---

<div class="post-metadata">

**Author:** ![hiteny](https://avatars.discourse-cdn.com/v4/letter/h/e47774/32.png) [@hiteny](https://discuss.elastic.co/u/hiteny)\
**Post date:** [December 31, 2021, 8:18am UTC](https://discuss.elastic.co/t/how-to-calculate-except-set-from-one-to-another/293244/2 "2021-12-31T08:18:03Z")

</div>

Test data:

```auto

#test data:
POST /testa/_bulk?refresh
{"index":{}}
{"session_id":1,"create_date":"2021-12-25","login_date":"2021-12-25"}
{"index":{}}
{"session_id":2,"create_date":"2021-12-25","login_date":"2021-12-25"}
{"index":{}}
{"session_id":3,"create_date":"2021-12-25","login_date":"2021-12-25"}
{"index":{}}
{"session_id":4,"create_date":"2021-12-25","login_date":"2021-12-25"}
{"index":{}}
{"session_id":5,"create_date":"2021-12-25","login_date":"2021-12-25"}

##day 2
POST /testa/_bulk?refresh
{"index":{}}
{"session_id":1,"create_date":"2021-12-25","login_date":"2021-12-25"}
{"index":{}}
{"session_id":3,"create_date":"2021-12-25","login_date":"2021-12-26"}
{"index":{}}
{"session_id":4,"create_date":"2021-12-25","login_date":"2021-12-26"}
{"index":{}}
{"session_id":6,"create_date":"2021-12-26","login_date":"2021-12-26"}

##day 2
POST /testa/_bulk?refresh
{"index":{}}
{"session_id":2,"create_date":"2021-12-25","login_date":"2021-12-27"}
{"index":{}}
{"session_id":3,"create_date":"2021-12-25","login_date":"2021-12-27"}
{"index":{}}
{"session_id":7,"create_date":"2021-12-27","login_date":"2021-12-27"}

```

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [December 31, 2021, 11:05am UTC](https://discuss.elastic.co/t/how-to-calculate-except-set-from-one-to-another/293244/3 "2021-12-31T11:05:31Z")

</div>

Hi, @hiteny

How about using [bucket selector aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html), which is a pipeline aggregation?

```auto
{
  "size":0,
  "query":{
    "bool":{
      "must":[{
        "range":{
          "login_date":{
            "gte": "2021-12-26",
            "lte": "2021-12-28"
          }
        }
      },{
        "term":{
          "create_date": {
            "value": "2021-12-25"
          }
        }
      }]
    }
  },
  "aggs":{
    "id":{
      "terms":{
        "field": "session_id",
        "size": 10000
      },
      "aggs":{
        "day1":{
          "filter": {
            "range":{
              "login_date":{
                "gte": "2021-12-26",
                "lte": "2021-12-27"
              }
            }
          }
        },
        "day2":{
          "filter": {
            "range":{
              "login_date":{
                "gte": "2021-12-27",
                "lte": "2021-12-28"
              }
            }
          }
        },
        "day_filter":{
          "bucket_selector": {
            "buckets_path": {
              "day1_count": "day1._count",
              "day2_count": "day2._count"
            },
            "script": "(params.day1_count>0)&&(params.day2_count==0)"
          }
        }
      }
    }
  }
}

```

```auto
{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 4,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : []
  },
  "aggregations" : {
    "id" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : 4,
          "doc_count" : 1,
          "day2" : {
            "doc_count" : 0
          },
          "day1" : {
            "doc_count" : 1
          }
        }
      ]
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 28, 2022, 12:04pm UTC](https://discuss.elastic.co/t/how-to-calculate-except-set-from-one-to-another/293244/5 "2022-01-28T12:04:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.