Elasticsearch aggregation over timestamp

Question

I'm having the following document in ElasticSearch:

"ipAddress": "192.168.10.12", "timestamp": "25 Oct 2015 20:00:00", "switchovers": 2

"ipAddress": "192.168.10.12", "timestamp": "26 Oct 2015 20:00:00", "switchovers": 1

How can I write an elasticsearch aggregation to find out switchovers[today] - switchovers[yesterday] grouped by IP address?

This is where i'm at:

{
"size": 0,
"query": {
  "match_all": {}
},
    "aggs": {
      "switchover_count_over_time": {
        "terms": {
          "field": "ipAddress"
        },
      }
  }
}'

Yet to figure out how to extract switchovers for each date (from oct. for example) and compute the difference from the previous day's switchover value..

Any help?

Answer 1

You can use date histogram aggregation on a date/timestamp field.Here is the linkhttps://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-datehistogram-aggregation.html.Add a terms aggregation on ipaddress/switchovers inside the date_histogram aggregation.

{
    "aggs" : {
        "date_interval" : {
            "date_histogram" : {
                "field" : "date",
                "interval" : "month"
            }, "aggs": {
              "switch_over": {
                "terms": {
                  "field": "ip/switchovers",
                  "size": 100
                }
              }
            }
        }
    }
}

Hope this works for you.