Max Bucket Aggregation on subaggregation?

Elastic Stack Elasticsearch
1

Here I'm aggregating by tag and by time:

{
  "aggregations": {
    "tags": {
      "aggregations": {
        "volume": {
          "histogram": {
            "field": "timestamp",
            "interval": 7200000
          }
        }
      },
      "terms": {
        "field": "tag"
      }
    },
    "max_volume": {
      "max_bucket": {
        "buckets_path": "tags>volume>_count"
      }
    }
  }
}

Furthermore there is a pipeline aggregation with which I'm trying to get the highest doc_count that any single tag in any single interval has. However, I'm getting an error:

buckets_path must reference either a number value or a single value numeric metric aggregation, got: java.lang.Object

I found that I can get my desired number by having two pipeline aggregations:

{
  "aggregations": {
    "tags": {
      "aggregations": {
        "volume": {
          "histogram": {
            "field": "timestamp",
            "interval": 7200000
          }
        },
        "max_tag_volume": {
          "max_bucket": {
            "buckets_path": "volume>_count"
          }
        }
      },
      "terms": {
        "field": "tag"
      }
    },
    "max_volume": {
      "max_bucket": {
        "buckets_path": "tags>max_tag_volume"
      }
    }
  }
}

I that how it's supposed to work? I would have expected that it's called buckets_path because I can specify a path down the aggregation tree?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.