Unable to make a bucketed aggregation by date histogram

Elastic Stack Elasticsearch
1

I have multiple documents ingested in my ES which are of the form -

{
    "weather":"cold",
    "date_1":"2017/07/05",
    "feedback":[
        {
                "date_2":"2017/08/07",
                "value":28,
                "comment":"not cold"
        },{
                "date_2":"2017/08/09",
                "value":48,
                "comment":"a bit chilly"
        },{
                "date_2":"2017/09/07",
                "value":18,
                "comment":"very cold"
        }, ...
     ]
}

I want to do 2 date aggregations here, but not sure how to move ahead with it.

  1. I want the aggregate average of all "feedback.value" by "date_1" where "weather" is "cold"
  2. I want the aggregate average of all "feedback.value" by "date_2" where "weather" is "cold"

I am not sure if such aggregate query are supported by ES. I was not able to resolve it going through the documentation.

Thanks for helping with this.

2

I was able to resolve the first part of the problem -

This can be aggregated using this -

GET _search
{
"query": {
        "query_string": {
                "query": "cold"
                 }
        },
"size": 0,
"aggs": {
        "temperature": {
                    "date_histogram":{
                                      "field" : "date_1",
                                      "interval" : "month"
                                      },
                      "aggs":{
                              "temperature_agg":{
                                                "terms": {
                                                        "field": "feedback.value"
                                                          }
                                                }
                              }

                    }
        }
}

Any help on the 2nd part would be helpful!

3

Hey,

with that data structure you should chedk the nested datatype as well as the nested aggregation in order to make sure you get the correct results.

Regarding your second problem. You could just add another agg named temperature_1 that filters on the date_2 field -as you can have more than one agg in a single request.

--Alex

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.