Outermost aggregation in Visual Builder cannot be (term) Bucket


(Alex) #1

Is there a way to start with a bucket filter in Visual Builder?
I want to do a bucket aggregation and have the child aggs of the outer bucket generate the time series of values.

Something like this query which works just fine in the dev console:

  "aggs": {  
    "series": { 
      "date_histogram": { "field": "@timestamp",  "interval": "hour"  } ,
      "aggs": {
        "bucket_by_host": { 
          "terms": { "field": "host" },
          "aggs": {
            "used"      : {"sum": { "field": "server-ram-b" } },
            "installed" : {"max": { "field": "host-ram-b" } },
            "ratio"     : { "bucket_script": { "buckets_path": {  "used": "used", "installed": "installed" }, "script": " (params.used / params.installed) " } }
          }
        },
       "total-ratio" : { "avg_bucket": {      "buckets_path": "bucket_by_host>ratio "    } }     
      }
    }
  }
}

(Marius Dragomir) #2

Hello,
Bucket script parent pipeline aggregation is available in TSVB, so you could build this using that. See an example in the image below:


(Alex) #3

If you can show me how to bucket by terms, then I will be happy.
I should probably retitle this issue to say that, but instead I've recently been looking at Vega Kibana plugin.
I had found the above already, but the larger ask is to be able to start with a term bucket.
I think I can use any query I want and point Vega at the results.
So, I'm moving to Vega for visualizing the responses from arbitrarily complicated queries.


(Alex) #4

Elastic support confirmed that it is not currently possible to start with a term bucket in Visual Builder.


(Marius Dragomir) #5

If you want to switch to Vega, feel free to open another issue so that other people notice it, that have better knowledge about it than me.


(Alex) #6

And the problem with Vega is that I don't think it pays attention to Kibana filters.


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.