I have a date_histogram aggregation first, however, I then wanna find out the count based on another field, which is calculated on the date in the result of date_histogram:
my document has the following structure:
{
name: 'test'
event_time: 2015-04-01,
activity_stream:{
2015-04-02: {'login':3, "openfile":5}
2015-04-04: {'login':2, "openfile":7}
.....
}
}
I essentially would need something like:
"aggregations": {
"by_day": {
"date_histogram": {
"field": "event_time",
"interval": "day"
},
"aggregations": {
"day_1":{
"filter": {
"range": {
"activity_stream.{DYNAMIC_FIELD}.login": {
"gt": 0
}
}
}
},
"day_2":{
}
}
}
}
The DYNAMIC_FIELD need to be calculated based on the date in the bucket of the date_histogram: I wanna find out on each day, how many users have loggedin in next 1,2,3 days.
Anyway to achieve this?
Chen