How to aggregate fields based particular date in every year in elasticsearch?

Question

I'm having data in my index from 2010 to 2015.

I have used following code to get the aggregated first name details in every year from 2010 to 2015, it works as expected

POST profile/_search
{
  "size": "0",
  "aggs": {
    "count_by_year": {
      "date_histogram": {
        "field": "logdate",
        "interval": "year",
        "format": "yyyy"
      },
      "aggs": {
        "count_by_firstname": {
          "terms": {
            "field": "profile.firstname"
          }
        }
      }
    }
  }
}

how to aggregate my data based on particular date in every year.

For Example, I would like to retrieve data from Feb. 15 to Apr. 15 in every year.

Do you still want to aggregate by year, but restrict results to only a portion of each year? Or do you want to aggregate by day? week? month? — Dusty, May 22 '15 at 19:47

Val · Answer 1 · 2015-05-23T22:08:49.353

4

You may try to use a filter aggregation with a script filter like this. Note that February 15th is the 46th day of the year and April 15th is the 105th day of the year (with an exception on leap years of course, but this illustrates a solution).

The script will take any document with a logdate between Feb 15th and Apr 15th (of any year) and then the date_histogram will dispatch them in the proper year buckets. Finally, the terms aggregation splits the counts by first names.

{
  "size": "0",
  "aggs": {
    "specific_period": {
      "filter": {
        "script": {
          "script": "doc.logdate.date.dayOfYear >= 46 && doc.logdate.date.dayOfYear <= 105"
        }
      },
      "aggs": {
        "byyear": {
          "date_histogram": {
            "field": "logdate",
            "interval": "year",
            "format": "yyyy"
          },
          "aggs": {
            "count_by_firstname": {
              "terms": {
                "field": "profile.firstname"
              }
            }
          }
        }
      }
    }
  }
}

edited May 23 '15 at 22:08

answered May 23 '15 at 04:22

Val

207,596
13
358
360

If possible provide me some constant solution please. – Pandiyan Cool May 25 '15 at 09:59
Is it possible to aggregate based on day of month? – Pandiyan Cool May 25 '15 at 11:18
Yes, simply use `doc.logdate.date.dayOfMonth` instead – Val May 25 '15 at 11:29
can we able to achieve this without using script – Pandiyan Cool May 25 '15 at 13:46

Neo-coder · Answer 2 · 2015-05-22T18:57:11.653

2

date range aggregation with range as below :

{
    "aggs": {
        "range": {
            "date_range": {
                "field": "logdate",
                "format": "YYYYMMDD",
                "ranges": [
                    {
                        "from": "20150201"
                    },
                    {
                        "to": "20150430"
                    }
                ]
            },
            "aggs": {
                "count_by_firstname": {
                    "terms": {
                        "field": "profile.firstname"
                    }
                }
            }
        }
    }
}

edited May 22 '15 at 18:57

answered May 22 '15 at 13:56

Neo-coder

7,715
4
33
52

1

I don't think that searches for a particular date range in EVERY year. This only searches for one specific range. The OP's question as I understood was for a query that "just" takes day and month as a range. I have a similar question look at http://stackoverflow.com/questions/30396242/how-to-do-a-time-range-search-in-kibana – markus May 22 '15 at 18:54

How to aggregate fields based particular date in every year in elasticsearch?

2 Answers2