elastic search by day aggregation, sum of two properties

Question

I'm trying to aggregate on the sum of two fields, but can't seem to get the syntax right.

Let's say I have the following aggregation:

 { "aggregations": { "byDay": { "date_histogram": { "field": "@timestamp", "interval": "1d" }, "aggregations": { "sum_a": { "sum": { "field": "a" } }, "sum_b": { "sum": { "field": "b" } }, "sum_a_and_b": { /* what goes here? */ } } } } } 

What I really want is an aggregation that is the sum of fields a and b.

It seem like something that would be simple, but I've hit a brick wall trying to get it right. Online examples have either been too simple (summing only on one field), or tried to do much more than this, so I've not found them helpful.

Answer 1

Try Terms Aggregation generating the terms using a script :

"aggs": {    
    "sum_a_and_b": {      
        "terms": {        
            "script": "doc['a'].value + doc['b'].value"      
        }    
    }  
}

In order to enable dynamic scripting add the following to your config file ( elasticsearch.yml by default) :

script.aggs: true # enable just for aggregations