1

I am not able to perform nested aggregation in a specific date range.

Ideally, I would want to get % values of two fields for the previous day and the current day. Here's the JSON (this is a part of the elastic watcher and not the whole config):

{
  "metadata":{
    "threshold":5,
    "interval":"2m",
    "window":"2d"
  },
  "trigger":{
    "schedule":{
      "interval":"2m"
    }
  },
  "input":{
    "search":{
      "request":{
        "indices":[
          "filebeat-*"
        ],
        "types":[
          "doc"
        ],
        "body": {
          "aggs": {
            "aggs1": {
              "range": {
                "date_range": {
                  "ranges": [
                    {
                      "from": "now-2d/d"
                    },
                    {
                      "to": "now-2d/d"
                    }
                  ]
                },
                "aggs": {
                  "max": {
                    "script": {
                      "source": "(doc['upstream'].value\/100)"
                    }
                  }
                }
              }
            },
            "aggs2": {
              "range": {    
                "date_range": {
                  "ranges": [
                    {
                      "from": "now-2d/d"
                    },
                    {
                      "to": "now-2d/d"
                    }
                  ]
                }  
              },
              "aggs": {
                "max": {
                  "script": {
                    "source": "(doc['downstream'].value\/100)"
                  }
                }
              }
            },
            "aggs3": {
              "range": {    
                "date_range": {
                  "ranges": [
                    {
                      "from": "now-1d/d"
                    },
                    {
                      "to": "now/d"
                    }
                  ]
                }  
              },
              "aggs": {
                "max": {
                  "script": {
                    "source": "(doc['upstream'].value\/100)"
                  }
                }
              }
            },
            "aggs4": {
              "range": {    
                "date_range": {
                  "ranges": [
                    {
                      "from": "now-1d/d"
                    },
                    {
                      "to": "now/d"
                    }
                  ]
                }   
              },
              "aggs": {
                "max": {
                  "script": {
                    "source": "(doc['downstream'].value\/100)"
                  }
                }
              }
            }
          },
          "query": {
            "bool": {
              "filter": {
                "range": {
                  "@timestamp": {
                    "lte": "now",
                    "gte": "now-{{ctx.metadata.window}}"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

All I want is to have 4 values for two fields for current day and previous day so that I can get the difference between the values for further procesing.

Thanks.

Shantanu Deshpande
  • 508
  • 1
  • 8
  • 17

0 Answers0