Howto use buckets_path for percentiles metric aggregation?

Elastic Stack Elasticsearch
1

Percentiles metric aggregtaion returns a multi-value result. And I know I can write buckets_path for multi-value like bucketsname.metricname.

But, the key of percentiles metric agg result is named like 50.0, 90.0, those also use DOT!

I try to forget the .0, and find something other more interesting:

Here is my request:

{
  "aggs" : {
    "my_date_histo" : {
      "date_histogram" : {
        "field" : "@timestamp",
        "interval" : "1h"
      },
      "aggs" : {
        "pcttime" : {
        "percentiles" : { "field" : "num_field" }
        },
        "the_movavg45" : {
          "moving_avg" : {
            "buckets_path" : "pcttime.45",
            "window" : 10,
            "model" : "simple"
          }
        },
        "the_movavg55" : {
          "moving_avg" : {
            "buckets_path" : "pcttime.55",
            "window" : 10,
            "model" : "simple"
          }
        },
        "the_movavg50" : {
          "moving_avg" : {
            "buckets_path" : "pcttime.50",
            "window" : 10,
            "model" : "simple"
          }
        }
      }
    }
  }
}

I use two NOT-EXISTS key (45, 55), but also got the response:

"aggregations" : {
    "my_date_histo" : {
      "buckets" : [ {
        "key_as_string" : "2015-12-24T02:00:00.000Z",
        "key" : 1450922400000,
        "doc_count" : 1462,
        "pcttime" : {
          "values" : {
            "1.0" : 8.61,
            "5.0" : 50.0,
            "25.0" : 259.7801169590643,
            "50.0" : 506.6208791208792,
            "75.0" : 752.2619047619047,
            "95.0" : 946.6333333333332,
            "99.0" : 994.0
          }
        }
      }, {
        "key_as_string" : "2015-12-24T03:00:00.000Z",
        "key" : 1450926000000,
        "doc_count" : 13077,
        "pcttime" : {
          "values" : {
            "1.0" : 10.25333333333333,
            "5.0" : 52.61263736263737,
            "25.0" : 253.4788589832068,
            "50.0" : 501.97747099662007,
            "75.0" : 752.0346378551421,
            "95.0" : 949.8349473684209,
            "99.0" : 988.0
          }
        },
        "the_movavg45" : {
          "value" : 466.2075
        },
        "the_movavg55" : {
          "value" : 564.8130952380953
        },
        "the_movavg50" : {
          "value" : 506.6208791208792
        }
      }, {
...

There are no 45, 55 in pcttime.values of percentiles metric aggregation. How can the pipeline got the value of pcttime.45, pcttime.55?

1 Like