ES pipeline aggregation - combining multiple buckets

Question

This is what I want to do: Let's say I am collecting disk usage metrics. Documents in elasticsearch have fields [ @timestamp, cluster, disk, host, value ]. Value is number of bytes used on a disk at given timestamp.

Now, as host have multiple disks and I am interested in total disk usage per host. The disk usage value is a gauge. Therefore I need to do a MAX aggregation over date histogram and then SUM all disks for cluster+host term bucket.

I am failing to figure out an aggregation for this. How can this be done with elasticseach?

Answer 1

According to information I got on elasticsearch IRC chat, this is not possible at all. Such aggregation must be performed by application.