A seemingly very trivial problem prompted me today to read the Elasticsearch documentation again diligently. So far, however, I have not come across the solution....

Question:
is ther's a simple way to set the doc_count of a filter aggregation in relation to the total doc_count?

Here's a snippet from my search-request-json.
In the feature_occurrences aggregation I filtered documents.
Now I want to calculate the ratio filtered/all Docs in each time bucket.

GET my_index/_search
{
  "aggs": {
    "time_buckets": {
      "date_histogram": {
        "field": "date",
        "calendar_interval": "1d",
        "min_doc_count": 0
      },
      "aggs": {
        "feature_occurrences": {
          "filter": {
            "term": {
              "x": "y"
            }
          }
        },
        "feature_occurrences_per_doc" : {
             
            // feature_occurences.doc_count / doc_count 
         
       }

       

Any Ideas ?

CodePudding user response：

You can use bucket_script to calc the ratio:

{
  "aggs": {
    "date": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "hour"
      },
      "aggs": {
        "feature_occurrences": {
          "filter": {
            "term": {
              "cloud.region": "westeurope"
            }
          }
        },
        "ratio": {
          "bucket_script": {
            "buckets_path": {
              "doc_count": "_count",
              "features_count": "feature_occurrences._count"
            },
            "script": "params.features_count / params.doc_count"
          }
        }
      }
    }
  }
}

Elastic bucket script doc:

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-script-aggregation.html