Subtraction of 90th and 10th percentile (percentile range)

[Piotr_Wasilewski (Piotr Boruc)]

Hi,

I was asked to create a query for records with response times in range between 10th and 90th percentile. These data are in single numeric field in documents.

I know I can get both of them with aggregation query, but I need to get value of range (90-10)th percentile and I was wondering if that is at all possible in single query without need of performing any additional computations on results.

with something like this:

"aggs":{"1":{"percentiles":{"field":"json.@fields.duration_ms","percents":["10","90"]}}

I'm getting two separate series of data instead of one, which I'm aiming for.

Thanks,
Peter

[polyfractal (Zachary Tong)]

I think it is doable with a bucket_script pipeline agg. E.g. the current percentiles aggregation that you have with 90 and 10 percentiles specified, then use the bucket_script to subtract one from the other.

On the run at the moment so I can't work up an example, but let me know if you have difficulties and I can try to make a demo when I'm back at the office