Numeric metrics aggregation on Nested key-value set

Elastic Stack Elasticsearch
1

Hi

Our index contains docs with a nested set of key-values, we would need to perform metric aggregation per key.

So we for example, we would need the average cpuTime per taskId for such docs:

    {
       "tasks" : [ 
          {  
             "taskId": "global_task_proc",
             "cpuTime": 600
         },
         {
             "taskId": "task_queue",
             "cpuTime": 594
         }
       ]
    }
2

Hi,

I think you are looking for the Nested Aggregation

Let me know if this is what you were looking for!

3

Hi thanks, I did look on the example there.
the example in the docs takes the maximum price of ANY reseller. but we need something like the maximum price for EACH reseller.

    {
      "resellers": [
        {
          "reseller": "companyA",
          "price": 350
        },
        {
          "reseller": "companyB",
          "price": 500
        }
      ]
    }

so the expected output might be something like:

    [
    {
       "key": "companyA",
       "maximum" : 670,
    },
    {
       "key": "companyB",
       "maximum" : 1120,
    }

    ]
4

Can you try running this query and see if it works?

GET /<YOUR_INDEX_PATTERN_HERE>/_search
{
    "query" : {
        <YOUR_QUERY_HERE>
    },
    "aggs" : {
        "resellers" : {
            "nested" : {
                "path" : "resellers"
            },
            "aggs" : {
                "resellers": {
                    "terms": { "field": "resellers.reseller" },
                    "aggs": {
                        "max_price" : { "max" : { "field" : "resellers.price" } }
                    }
                }
            }
        }
    }
}

I'm not 100% sure that a terms aggregation would work here, but I cannot try it at the moment. Let me know how this turns out.

1 Like
5

Hi this is the exact solution, worked on the first try.
Thank you so much!

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.