Not sure if this is possible, any help is greatly appreciated... I have time-based events with two date fields: start time and end time. I'd like to count amount of active events at any given time, i.e. how many events were active every second. It means the same document should be counted several …

That's a tough one due to the nature of the event spanning multiple time buckets. I can't immediately think of anything that could do this, but maybe someone else can.

Make a script-thingy that returns an array of datetimes (say, 1 element for each day) and then do a group-by/aggregate-bucket on the whole array ? This way each document will have multiple-values, and it will be counted on several days.

Thanks, worked like a charm :slight_smile:

How to double count events?

Elastic Stack Elasticsearch

Christian_Dahlqvist (Christian Dahlqvist) March 2, 2016, 6:18am 4

Here is a link to a thread that discussed how to do something similar in Kibana using a scripted metrics aggregation. The aggregation example, which is based in start date and duration rather than start and end date, can be found here.

Topic		Replies	Views
Counting an event in multiple buckets Kibana	3	1280	June 20, 2018
Get counts of events happening(not ended) currently Kibana	6	553	May 22, 2018
Question on multiple date fields in an event and time range Kibana	5	993	May 11, 2019
Aggregate two same events in a small time range Elasticsearch	1	498	May 30, 2017
Could I query all docs where there are multiple occurrences of my term? Elasticsearch	3	1698	February 11, 2019

How to double count events?

Related topics