datehistogram-aggregation.asciidoc 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137
  1. [[search-aggregations-bucket-datehistogram-aggregation]]
  2. === Date Histogram Aggregation
  3. A multi-bucket aggregation similar to the <<search-aggregations-bucket-histogram-aggregation,histogram>> except it can
  4. only be applied on date values. Since dates are represented in elasticsearch internally as long values, it is possible
  5. to use the normal `histogram` on dates as well, though accuracy will be compromised. The reason for this is in the fact
  6. that time based intervals are not fixed (think of leap years and on the number of days in a month). For this reason,
  7. we need special support for time based data. From a functionality perspective, this histogram supports the same features
  8. as the normal <<search-aggregations-bucket-histogram-aggregation,histogram>>. The main difference is that the interval can be specified by date/time expressions.
  9. Requesting bucket intervals of a month.
  10. [source,js]
  11. --------------------------------------------------
  12. {
  13. "aggs" : {
  14. "articles_over_time" : {
  15. "date_histogram" : {
  16. "field" : "date",
  17. "interval" : "month"
  18. }
  19. }
  20. }
  21. }
  22. --------------------------------------------------
  23. Available expressions for interval: `year`, `quarter`, `month`, `week`, `day`, `hour`, `minute`, `second`
  24. Fractional values are allowed for seconds, minutes, hours, days and weeks. For example 1.5 hours:
  25. [source,js]
  26. --------------------------------------------------
  27. {
  28. "aggs" : {
  29. "articles_over_time" : {
  30. "date_histogram" : {
  31. "field" : "date",
  32. "interval" : "1.5h"
  33. }
  34. }
  35. }
  36. }
  37. --------------------------------------------------
  38. See <<time-units>> for accepted abbreviations.
  39. ==== Time Zone
  40. By default, times are stored as UTC milliseconds since the epoch. Thus, all computation and "bucketing" / "rounding" is
  41. done on UTC. It is possible to provide a time zone (both pre rounding, and post rounding) value, which will cause all
  42. computations to take the relevant zone into account. The time returned for each bucket/entry is milliseconds since the
  43. epoch of the provided time zone.
  44. The parameters are `pre_zone` (pre rounding based on interval) and `post_zone` (post rounding based on interval). The
  45. `time_zone` parameter simply sets the `pre_zone` parameter. By default, those are set to `UTC`.
  46. The zone value accepts either a numeric value for the hours offset, for example: `"time_zone" : -2`. It also accepts a
  47. format of hours and minutes, like `"time_zone" : "-02:30"`. Another option is to provide a time zone accepted as one of
  48. the values listed here.
  49. Lets take an example. For `2012-04-01T04:15:30Z`, with a `pre_zone` of `-08:00`. For day interval, the actual time by
  50. applying the time zone and rounding falls under `2012-03-31`, so the returned value will be (in millis) of
  51. `2012-03-31T00:00:00Z` (UTC). For hour interval, applying the time zone results in `2012-03-31T20:15:30`, rounding it
  52. results in `2012-03-31T20:00:00`, but, we want to return it in UTC (`post_zone` is not set), so we convert it back to
  53. UTC: `2012-04-01T04:00:00Z`. Note, we are consistent in the results, returning the rounded value in UTC.
  54. `post_zone` simply takes the result, and adds the relevant offset.
  55. Sometimes, we want to apply the same conversion to UTC we did above for hour also for day (and up) intervals. We can
  56. set `pre_zone_adjust_large_interval` to `true`, which will apply the same conversion done for hour interval in the
  57. example, to day and above intervals (it can be set regardless of the interval, but only kick in when using day and
  58. higher intervals).
  59. ==== Offset
  60. The `offset` option can be provided for shifting the date bucket intervals boundaries after any other shifts because of
  61. time zones are applies. This for example makes it possible that daily buckets go from 6AM to 6AM the next day instead of starting at 12AM
  62. or that monthly buckets go from the 10th of the month to the 10th of the next month instead of the 1st.
  63. The `offset` option accepts positive or negative time durations like "1h" for an hour or "1M" for a Month. See <<time-units>> for more
  64. possible time duration options.
  65. ==== Keys
  66. Since internally, dates are represented as 64bit numbers, these numbers are returned as the bucket keys (each key
  67. representing a date - milliseconds since the epoch). It is also possible to define a date format, which will result in
  68. returning the dates as formatted strings next to the numeric key values:
  69. [source,js]
  70. --------------------------------------------------
  71. {
  72. "aggs" : {
  73. "articles_over_time" : {
  74. "date_histogram" : {
  75. "field" : "date",
  76. "interval" : "1M",
  77. "format" : "yyyy-MM-dd" <1>
  78. }
  79. }
  80. }
  81. }
  82. --------------------------------------------------
  83. <1> Supports expressive date <<date-format-pattern,format pattern>>
  84. Response:
  85. [source,js]
  86. --------------------------------------------------
  87. {
  88. "aggregations": {
  89. "articles_over_time": {
  90. "buckets": [
  91. {
  92. "key_as_string": "2013-02-02",
  93. "key": 1328140800000,
  94. "doc_count": 1
  95. },
  96. {
  97. "key_as_string": "2013-03-02",
  98. "key": 1330646400000,
  99. "doc_count": 2
  100. },
  101. ...
  102. ]
  103. }
  104. }
  105. }
  106. --------------------------------------------------
  107. Like with the normal <<search-aggregations-bucket-histogram-aggregation,histogram>>, both document level scripts and
  108. value level scripts are supported. It is also possible to control the order of the returned buckets using the `order`
  109. settings and filter the returned buckets based on a `min_doc_count` setting (by default all buckets with
  110. `min_doc_count > 0` will be returned). This histogram also supports the `extended_bounds` setting, which enables extending
  111. the bounds of the histogram beyond the data itself (to read more on why you'd want to do that please refer to the
  112. explanation <<search-aggregations-bucket-histogram-aggregation-extended-bounds,here>>).