Bucket selector aggregation
editBucket selector aggregation
editA parent pipeline aggregation which executes a script which determines whether the current bucket will be retained
in the parent multi-bucket aggregation. The specified metric must be numeric and the script must return a boolean value.
If the script language is expression
then a numeric return value is permitted. In this case 0.0 will be evaluated as false
and all other values will evaluate to true.
The bucket_selector aggregation, like all pipeline aggregations, executes after all other sibling aggregations. This means that using the bucket_selector aggregation to filter the returned buckets in the response does not save on execution time running the aggregations.
Syntax
editA bucket_selector
aggregation looks like this in isolation:
{ "bucket_selector": { "buckets_path": { "my_var1": "the_sum", "my_var2": "the_value_count" }, "script": "params.my_var1 > params.my_var2" } }
Here, |
Table 55. bucket_selector
Parameters
Parameter Name | Description | Required | Default Value |
---|---|---|---|
|
The script to run for this aggregation. The script can be inline, file or indexed. (see Scripting for more details) |
Required |
|
|
A map of script variables and their associated path to the buckets we wish to use for the variable
(see |
Required |
|
|
The policy to apply when gaps are found in the data (see Dealing with gaps in the data for more details) |
Optional |
|
The following snippet only retains buckets where the total sales for the month is more than 200:
resp = client.search( index="sales", size=0, aggs={ "sales_per_month": { "date_histogram": { "field": "date", "calendar_interval": "month" }, "aggs": { "total_sales": { "sum": { "field": "price" } }, "sales_bucket_filter": { "bucket_selector": { "buckets_path": { "totalSales": "total_sales" }, "script": "params.totalSales > 200" } } } } }, ) print(resp)
response = client.search( index: 'sales', body: { size: 0, aggregations: { sales_per_month: { date_histogram: { field: 'date', calendar_interval: 'month' }, aggregations: { total_sales: { sum: { field: 'price' } }, sales_bucket_filter: { bucket_selector: { buckets_path: { "totalSales": 'total_sales' }, script: 'params.totalSales > 200' } } } } } } ) puts response
const response = await client.search({ index: "sales", size: 0, aggs: { sales_per_month: { date_histogram: { field: "date", calendar_interval: "month", }, aggs: { total_sales: { sum: { field: "price", }, }, sales_bucket_filter: { bucket_selector: { buckets_path: { totalSales: "total_sales", }, script: "params.totalSales > 200", }, }, }, }, }, }); console.log(response);
POST /sales/_search { "size": 0, "aggs": { "sales_per_month": { "date_histogram": { "field": "date", "calendar_interval": "month" }, "aggs": { "total_sales": { "sum": { "field": "price" } }, "sales_bucket_filter": { "bucket_selector": { "buckets_path": { "totalSales": "total_sales" }, "script": "params.totalSales > 200" } } } } } }
And the following may be the response:
{ "took": 11, "timed_out": false, "_shards": ..., "hits": ..., "aggregations": { "sales_per_month": { "buckets": [ { "key_as_string": "2015/01/01 00:00:00", "key": 1420070400000, "doc_count": 3, "total_sales": { "value": 550.0 } }, { "key_as_string": "2015/03/01 00:00:00", "key": 1425168000000, "doc_count": 2, "total_sales": { "value": 375.0 } } ] } } }