# Sliding date range aggs

**URL:** <https://discuss.elastic.co/t/sliding-date-range-aggs/695>\
**Category:** Elasticsearch\
**Created:** [May 14, 2015, 3:40pm UTC](https://discuss.elastic.co/t/sliding-date-range-aggs/695 "2015-05-14T15:40:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rrva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rrva/32/43888_2.png) [@rrva](https://discuss.elastic.co/u/rrva)\
**Post date:** [May 14, 2015, 3:40pm UTC](https://discuss.elastic.co/t/sliding-date-range-aggs/695/1 "2015-05-14T15:40:44Z")

</div>

Hello.

I have indexed docs describing session activity, with timestamp and session\_id fields.

I want to count the active sessions using this definition:

A session is active if for any point in time T, there has been at least one session activity doc within T-75s, but multiple docs with same session\_id do not count double.

Then I want this aggregated into date buckets, for example 15 second buckets over an hours worth of data.

So far, the only approach has been something like the below.

Is there something cleaner than this?

```
"aggs": {
    "15s_ranges": {
        "date_range": {
            "field": "timestamp",
            "ranges": [
            { "to": "now", "from": "now-75s" },
            { "to": "now-15s", "from": "now-90s" },
            { "to": "now-30s", "from": "now-105s" },
            { "to": "now-45s", "from": "now-120s" },
            { "to": "now-60s", "from": "now-135s" },
           ...
            ]
        },
        "aggs": {
            "unique_count_of_session_id": {
                "cardinality": {
                    "field": "session_id"
                }
            }
        }
    }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:14am UTC](https://discuss.elastic.co/t/sliding-date-range-aggs/695/2 "2017-07-06T00:14:01Z")

</div>

Closed on July 6, 2017, 12:14am UTC