WARNING: Version 2.4 of Elasticsearch has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Bucket Script Aggregation
editBucket Script Aggregation
editThis functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
A parent pipeline aggregation which executes a script which can perform per bucket computations on specified metrics in the parent multi-bucket aggregation. The specified metric must be numeric and the script must return a numeric value.
Syntax
editA bucket_script
aggregation looks like this in isolation:
{ "bucket_script": { "buckets_path": { "my_var1": "the_sum", "my_var2": "the_value_count" }, "script": "my_var1 / my_var2" } }
Here, |
Table 11. bucket_script
Parameters
Parameter Name | Description | Required | Default Value |
---|---|---|---|
|
The script to run for this aggregation. The script can be inline, file or indexed. (see Scripting for more details) |
Required |
|
|
A map of script variables and their associated path to the buckets we wish to use for the variable
(see |
Required |
|
|
The policy to apply when gaps are found in the data (see Dealing with gaps in the data for more details) |
Optional, defaults to |
|
|
format to apply to the output value of this aggregation |
Optional, defaults to |
The following snippet calculates the ratio percentage of t-shirt sales compared to total sales each month:
{ "aggs" : { "sales_per_month" : { "date_histogram" : { "field" : "date", "interval" : "month" }, "aggs": { "total_sales": { "sum": { "field": "price" } }, "t-shirts": { "filter": { "term": { "type": "t-shirt" } }, "aggs": { "sales": { "sum": { "field": "price" } } } }, "t-shirt-percentage": { "bucket_script": { "buckets_path": { "tShirtSales": "t-shirts>sales", "totalSales": "total_sales" }, "script": "tShirtSales / totalSales * 100" } } } } } }
And the following may be the response:
{ "aggregations": { "sales_per_month": { "buckets": [ { "key_as_string": "2015/01/01 00:00:00", "key": 1420070400000, "doc_count": 3, "total_sales": { "value": 50 }, "t-shirts": { "doc_count": 2, "sales": { "value": 10 } }, "t-shirt-percentage": { "value": 20 } }, { "key_as_string": "2015/02/01 00:00:00", "key": 1422748800000, "doc_count": 2 "total_sales": { "value": 60 }, "t-shirts": { "doc_count": 1, "sales": { "value": 15 } }, "t-shirt-percentage": { "value": 25 } }, { "key_as_string": "2015/03/01 00:00:00", "key": 1425168000000, "doc_count": 2, "total_sales": { "value": 40 }, "t-shirts": { "doc_count": 1, "sales": { "value": 20 } }, "t-shirt-percentage": { "value": 50 } } ] } } }