How to do date histogram again after date histogram aggregation?

Question

Now my aggregation is 5 min date histogram aggregation and then sum the result in every 5 min.

Now my DSL is similar to:

{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "time": {
              "gt": "2020-03-31 11:30:00",
              "lt": "2020-03-31 13:00:00"
            }
          }
        },
        {
          "term": {
            "domain": "s3plus-shon.meituan.net"
          }
        }
      ]
    }
  },
  "aggs": {
    "flux_stats": {
      "date_histogram": {
        "field": "time",
        "interval": "5m",
        "format": "yyyy-MM-dd HH:mm:ss"
      },
      "aggs": {
        "flux": {
          "sum": {
            "field": "visit_flux"
          }
        }
      }
    }
  }
}

But I want to do date histogram sub aggregation again on the result, that interval is 30 min and need to find the max value in every 30 min, how can I do that?

Answer 1

You can do it like this: first by having 30m intervals and getting the max for each 30m period and then using 5m sub-intervals with the sums for 5m periods.

{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "time": {
              "gt": "2020-03-31 11:30:00",
              "lt": "2020-03-31 13:00:00"
            }
          }
        },
        {
          "term": {
            "domain": "s3plus-shon.meituan.net"
          }
        }
      ]
    }
  },
  "aggs": {
    "flux_stats": {
      "date_histogram": {
        "field": "time",
        "interval": "30m",
        "format": "yyyy-MM-dd HH:mm:ss"
      },
      "aggs": {
        "flux": {
          "max": {
            "field": "visit_flux"
          }
        },
        "flux_stats": {
          "date_histogram": {
            "field": "time",
            "interval": "5m",
            "format": "yyyy-MM-dd HH:mm:ss"
          },
          "aggs": {
            "flux": {
              "sum": {
                "field": "visit_flux"
              }
            }
          }
        }
      }
    }
  }
}