A parent pipeline aggregation consumes the output of a child metric or bucket aggregation and adds a new aggregation or buckets inside the existing parent buckets. This differs from a sibling pipeline aggregation, which creates its result at the same level as the source aggregation. section 13.4.1 section 13.5.1
Use the structure to identify where the calculation belongs:
- Place a bucket aggregation such as date_histogram at the parent level. section 13.5.5
- Define a child metric aggregation, such as a sum of cappuccino sales. section 13.4.1
- Add the pipeline aggregation beside that child metric and identify its input with buckets_path. section 13.5.3
- Read the calculated value from each existing parent bucket. section 13.5.5
Cumulative cappuccino sales by day
GET coffee_sales/_search { "size": 0, "aggs": { "sales_by_coffee": { "date_histogram": { "field": "date", "calendar_interval": "1d" }, "aggs": { "cappuccino_sales": { "sum": { "field": "sales.cappuccino" } }, "total_cappuccinos": { "cumulative_sum": { "buckets_path": "cappuccino_sales" } } } } } } Here, cappuccino_sales supplies the daily input and total_cappuccinos accumulates it within sales_by_coffee. With daily values of 23 and 40, the returned cumulative values are 23 and 63. section 13.5.5
Listing 13.22 Cumulative sales (sum) of cappuccinos sold daily
GET coffee_sales/_search { "size": 0, "aggs": { "sales_by_coffee": { "date_histogram": { "field": "date", "calendar_interval": "1d" }, "aggs": { "cappuccino_sales": { "sum": { "field": "sales.cappuccino" } }, "total_cappuccinos": { "cumulative_sum": { #1 "buckets_path": "cappuccino_sales" } } } } } } #1 Parent aggregation that calculates the cumulative total of cappuccino sales
Inspect the complete REST aggregation query for a runnable parent pipeline example. section 13.5.5
