# Issue with specifying the correct buckets\_path

**URL:** https://discuss.elastic.co/t/issue-with-specifying-the-correct-buckets-path/93950
**Category:** Elasticsearch
**Created:** [July 20, 2017, 1:35pm UTC](https://discuss.elastic.co/t/issue-with-specifying-the-correct-buckets-path/93950 "2017-07-20T13:35:48Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Michael.Craig](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@Michael.Craig](https://discuss.elastic.co/u/Michael.Craig)
#### Post date: [July 20, 2017, 1:35pm UTC](https://discuss.elastic.co/t/issue-with-specifying-the-correct-buckets-path/93950/1 "2017-07-20T13:35:48Z")

</div>

Hello,  
I am trying to find the hourly maximum of a date\_histogram aggregation with an interval of 1 hour.

I have looked at the documentation for pipeline aggregations, which is useful and interesting but I cannot correctly apply it for my case.

[https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline.html#buckets-path-syntax](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline.html#buckets-path-syntax)

```auto
GET test/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match": {"Collection": "XSF"}
        }]
    }
  },
  "aggs": {
    "group_by_service": 
      {
        "terms": 
        {"field": "Name.keyword",
        "size": 1},
        "aggs": {
          "hourly": {
          "date_histogram": {
            "field": "@timestamp",
            "interval": "hour",
            "time_zone": "+01:00"
          },
          "aggs": {
            "sum_the_count": {
              "sum": {
                "field": "Count"
            }
          }
        }
      }
    }},
    "max_hourly_sv": {
      "max_bucket": {
        "buckets_path": "group_by_service.sum_the_count"
      }
    }
  }
}

```

Output that pertains to my question is as follows

```auto
"max_hourly_sv": {
      "value": null,
      "keys": []
    }
  }

```

Using

```auto
"buckets_path": "group_by_service>hourly.sum_the_count"

```

Returns the error

```auto
"caused_by": {
      "type": "aggregation_execution_exception",
      "reason": "buckets_path must reference either a number value or a single value numeric metric aggregation, got: java.lang.Object[]"

```

I feel as though I am misunderstanding or misusing the syntax of buckets\_path.

Thanks.

Also (apologies!) how do I format the relevant sections of my question as it looks in Dev Tools.

---

<div class="post-metadata">

### Author: ![PaulieMac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pauliemac/32/19480_2.png) [@PaulieMac](https://discuss.elastic.co/u/PaulieMac)
#### Post date: [July 20, 2017, 3:04pm UTC](https://discuss.elastic.co/t/issue-with-specifying-the-correct-buckets-path/93950/2 "2017-07-20T15:04:23Z")

</div>

I have some aggs that do something vaguely similar, I have attempted to adapt your query to the pattern I use - hopefully the syntax is good (I am not in front of an ES cluster at the mo to test it!) 🙂

Basically, I am not sure if the bucket syntax can go that extra level your original query would need (i.e. sibling\>child\>grandchild). I've never tried! What I have done below is add the 'max\_hourly\_inner' bucket agg as an intermediary step, so the 'outer' bucket agg has a 'sibling\>child' to target... Hope this helps!

```auto
{
	"size": 0,
	"query": {
		"bool": {
			"must": [{
				"match": {"Collection": "XSF"}
			}]
		}
	},
	"aggs": {
		"group_by_service": {
			"terms": {"field": "Name.keyword", "size": 1},
			"aggs": {
				"hourly": {
					"date_histogram": {
						"field": "@timestamp",
						"interval": "hour",
						"time_zone": "+01:00"
					},
					"aggs": {
						"sum_the_count": {
							"sum": {
								"field": "Count"
							}
						}
					}
				},
				"max_hourly_inner": {
					"max_bucket": {
					"buckets_path": "hourly>sum_the_count"
					}
				}
			}
		},
		"max_hourly_sv": {
			"max_bucket": {
			"buckets_path": "group_by_service>max_hourly_inner"
			}
		}
	}
}

```

---

<div class="post-metadata">

### Author: ![PaulieMac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pauliemac/32/19480_2.png) [@PaulieMac](https://discuss.elastic.co/u/PaulieMac)
#### Post date: [July 20, 2017, 3:07pm UTC](https://discuss.elastic.co/t/issue-with-specifying-the-correct-buckets-path/93950/3 "2017-07-20T15:07:17Z")

</div>

Oh, and by opening and closing a block of text in three ' symbols, it will make it format like code:

```  
hello world()  
exit()  
```

becomes

```auto
hello world()
exit()

```

---

<div class="post-metadata">

### Author: ![Michael.Craig](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@Michael.Craig](https://discuss.elastic.co/u/Michael.Craig)
#### Post date: [July 20, 2017, 4:29pm UTC](https://discuss.elastic.co/t/issue-with-specifying-the-correct-buckets-path/93950/4 "2017-07-20T16:29:16Z")

</div>

That has worked perfectly thanks very much! 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 17, 2017, 4:29pm UTC](https://discuss.elastic.co/t/issue-with-specifying-the-correct-buckets-path/93950/5 "2017-08-17T16:29:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
