I have the following query where
- query will return 7 hits and if execute without agg, it complete in 62ms.
- removing nested "hour_bucket" agg will complete in 180ms
- but executing nested aggs takes about 1 min
is the query below the only aggregate against 7 documents only or doing something else?
Is there any way to improve?
mapping
{
"user_id":{"type":"keyword"},
"connected":{"type":"keyword"},
"start_time":{"type":"date","format":"yyyyMMddHHmmss.SSS"},
"record_id": {"type":"keyword"}
}
query: my-index/_search?size=0
{
"query": {
"bool": {
"filter": [<filters...>]
}
},
"aggs": {
"users": {
"terms": {
"size": 2147483647,
"field": "user_id"
},
"aggs": {
"hour_buckets": {
"aggs": {
"Missed": {
"filter": {
"bool": {
"must_not": {
"term": {
"connected": "Yes"
}
}
}
},
"aggs": {
"Missed": {
"sum": {
"field": "inbound"
}
}
}
},
"Answered": {
"filter": {
"term": {
"connected": "Yes"
}
},
"aggs": {
"Answered": {
"value_count": {
"field": "record_id"
}
}
}
}
},
"terms": {
"min_doc_count": 0,
"script": "doc['start_time'].date.hourOfDay",
"size": 24
}
}
}
}
}
}