# Pipeline Aggregation

**URL:** https://discuss.elastic.co/t/pipeline-aggregation/56051
**Category:** Elasticsearch
**Created:** [July 21, 2016, 3:00am UTC](https://discuss.elastic.co/t/pipeline-aggregation/56051 "2016-07-21T03:00:06Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Sridhar\_Yadav\_Manoha](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@Sridhar\_Yadav\_Manoha](https://discuss.elastic.co/u/Sridhar_Yadav_Manoha)
#### Post date: [July 21, 2016, 3:00am UTC](https://discuss.elastic.co/t/pipeline-aggregation/56051/1 "2016-07-21T03:00:06Z")

</div>

How do I get average of transcations(count) per minute over a large set of data.

I am currently using this:

curl -XGET 'localhost:9200/splunkindex/\_search?scroll=10m&pretty' -d '{ "query": { "filtered": { "query": { "match\_all": {} } } }, {  
"aggs" : {  
"requests\_per\_minute" : {  
"date\_histogram" : {  
"field" : "timestamp",  
"interval" : "minute"  
},  
"aggs": {  
"requests": {  
"sum": {  
"field": "txn"  
}  
}  
}  
},  
"avg\_minutely\_requests": {  
"avg\_bucket": {  
"buckets\_path": "requests\_per\_minute\>requests"  
}  
}  
}  
} } ' | jq '.hits.hits[].\_source' | jq 'keys'

But it fails.  
txn is a string - transaction name  
I have to find number of occurance of transcation per minute

---

<div class="post-metadata">

### Author: ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)
#### Post date: [July 21, 2016, 8:14am UTC](https://discuss.elastic.co/t/pipeline-aggregation/56051/2 "2016-07-21T08:14:43Z")

</div>

Not sure if I fully understand what you are wanting to do but if you are wanting to average the count of transactions per minute then you could use the `value_count` aggregation instead of the `sum` aggregation inside your `date_histogram` aggregation

---

<div class="post-metadata">

### Author: ![Sridhar\_Yadav\_Manoha](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@Sridhar\_Yadav\_Manoha](https://discuss.elastic.co/u/Sridhar_Yadav_Manoha)
#### Post date: [July 21, 2016, 7:16pm UTC](https://discuss.elastic.co/t/pipeline-aggregation/56051/3 "2016-07-21T19:16:41Z")

</div>

Hello Colin,

Thanks for the correct response.  
My use case is now that I got the number of transactions per second using value\_count. I need to find the percentage of requests/second falling under say 0-2 , 2-4 , 4-6 , 6-8, 8-10.  
That is, what is the percentage of requests /second falling under those ranges.  
How do I compute this?

curl -XGET 'localhost:9200/splunkjob/\_search?size=1&pretty=true' -d '{ "query": { "filtered": { "query": { "bool": { "must": [{ "match": { "txn": "/api/secure/matcher" } }] } } } },  
"aggs" : {  
"requests\_per\_second" : {  
"date\_histogram" : {  
"field" : "@timestamp",  
"interval" : "second"  
},  
"aggs": {  
"requests": {  
"value\_count": {  
"field": "txn"  
}  
}  
}  
},  
"stats\_secondly\_requests": {  
"stats\_bucket": {  
"buckets\_path": "requests\_per\_second\>requests"  
}  
}  
}  
} } '

Here requests -\> gives me the request per second.  
Using the stats\_bucket, I am able to find count,min,max,sum,average.  
Now i need to find the percentages of requests/second under 0-2 , 2-4 , 4-6 , 6-8, 8-10(dynamic ranges) etc requests/second. Is this possible using Elasticsearch.

---

<div class="post-metadata">

### Author: ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)
#### Post date: [July 22, 2016, 8:21am UTC](https://discuss.elastic.co/t/pipeline-aggregation/56051/4 "2016-07-22T08:21:42Z")

</div>

Unfortunately we don't currently have a `percentile_ranks_bucket` pipeline aggregation which is the aggregation you would need to do this. We do have a [`percentiles_bucket`](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/search-aggregations-pipeline-percentiles-bucket-aggregation.html) aggregation which answers the opposite question: How much requests/second does 20%, 50%, 90% etc. of the values fall under.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 10:33pm UTC](https://discuss.elastic.co/t/pipeline-aggregation/56051/5 "2017-07-05T22:33:29Z")

</div>


