Bucket Script Aggregation - Elastic Search

557 Views Asked by At

I'm trying to build a query at Elastic Search, in order to get the difference of two values:

Here's the code I'm using:

GET /monitora/_search
{
  "size":0,
  "aggs": {
    "CALC_DIFF": {
      "filters": {
        "filters": {
          "FTS_callback": {"term":{ "msgType": "panorama_fts"}},
          "FTS_position": {"term":{ "msgType": "panorama_position"}}
                  }
                },
        "aggs": {
          "subtract": {
            "bucket_script": {
              "buckets_path": {
                "PCountCall": "_count",
                "PcountPos":"_count"
              },
              "script": "params.PCountCall - params.PcountPos"
            }
          }
        }
      }
 }
}

And this is what I get back when I run it:

{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "CALC_DIFF" : {
      "buckets" : {
        "FTS_callback" : {
          "doc_count" : 73530,
          "subtract" : {
            "value" : 0.0
          }
        },
        "FTS_position" : {
          "doc_count" : 156418,
          "subtract" : {
            "value" : 0.0
          }
        }
      }
    }
  }
}

However, instead of getting the subtraction inside these buckets (which will always be zero), I was looking for the subtraction of the counts on each bucket, which would return me (73530 - 156418) following this example.

After that, I would like to display the result as a "metric" visualization element in Kibana. Is it possible?

Could anyone give me a hand to get it right?

Thanks in advance!

0

There are 0 best solutions below