Unfortunately there is no out of the box solution for this.
What I can think of:
You could in addition to you existing
group_by further group by
histogram. In the aggregation you need to calculate an average for that bucket and you need the count of documents (
value_count on one of the
The transform would create a document for every histogram bucket. In a 2nd pass you can query the transform dest index, using a
range query to filter out the outliers and aggregate using a weighted average aggregations, this is where you need the count as weight.
The other idea: filter the outliers already in the transform or use a filter aggregation in the transform with a
avg child aggregation.
To get the left and right cut off value you can use a
To sum it up, I do not see a solution that can be easily implemented but both ideas require extra work and additional queries or at least 2 transforms.