Subtract two doc counts from one another

Elastic Stack Elasticsearch
1

Hi,
I'm currently trying to find out how large the difference between the number of two seperate events is.
This is the response I get when I search for my events:
"aggregations": { "aggname": { "buckets": { "event1": { "doc_count": 121 }, "event2": { "doc_count": 119 } } } }

I got this result by running
"aggs": { "aggname": { "filters": { "filters": { "event1": { "query": { "query_string": { "query": "event1" } } }, "event2": { "query": { "query_string": { "query": "event2" } } } } } } }

I'm now trying to calculate the difference, but I cant get the bucket path to work...
I tried doing it like this and a few other ways, but had no success so far:
"aggs": { "aggname": { "filters": { "filters": { "event1": { "query": { "query_string": { "query": "event1" } } }, "event2": { "query": { "query_string": { "query": "event2" } } } } }, "aggs": { "aggscript": { "bucket_script": { "buckets_path": { "my_var1": "event1>count", "my_var2": "event2>count" }, "script": "my_var1 - my_var2" } } } } }

1 Like
2

I think this won't work because the bucket script aggregation is a parent aggregation and your example does not have it structured as such.

I have exactly the same requirement so if anyone else knows how to do this without writing a custom client, please suggest !

1 Like