0

I would like to get the hourly average number of events happened in the last hour. All the events must have the field "DayType" equal to "T1" and the field "Town" equal to "NA".

My basic working query is the following. However, I don't know how to add the filter by the field "DayType" and "Town".

POST /myindex/_search
{
  "size": 0,
  "aggs": {
    "range": {
        "date_range": {
            "field": "Datetime",
            "ranges": [
                { 
                   "from": "now-1H/H",
                   "to": "now/H" 
                }
            ]
        }
    }
}
}
Dinosaurius
  • 8,306
  • 19
  • 64
  • 113

1 Answers1

1

You can add a bool/filter constraint in your query so the aggregations only get computed on the selected documents:

POST /myindex/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {"term": {"DayType": "T1"}},
        {"term": {"Town": "NA"}}
      ]
    }
  },
  "aggs": {
    "range": {
        "date_range": {
            "field": "Datetime",
            "ranges": [
                { 
                   "from": "now-1H/H",
                   "to": "now/H" 
                }
            ]
        }
    }
}
}
Val
  • 207,596
  • 13
  • 358
  • 360