Operations on "doc_count"


(Dave ) #1

I have an issue that is not unlike this request...

Apply a simple math operation to doc_count

We have events rolling in, we look at them and check for certain features. We mark them with a sort of classification scheme. Say "Apples" and "Bananas".

I can "aggs" on that scheme and get a doc_count for Apples and Bananas.

Is there a way to get the Apple to Banana ratio?

I see this is open: doc_count metric agg

I had the thought of logstash -> mutate -> add_field something like { "__count_me": 1 } so I could do math over that. Is there another way out?

Has anyone skinned this cat in a clever way? :smiley:

Thanks!

-ave


(system) #2