So far, we have just sliced the data across time by using the Date Histogram to create the buckets on the time field. This gave us the document counts in each bucket. Next, we will try to answer the following question:

What is the day-wise total bandwidth usage for a given customer?

The following query will provide us with an answer for this:

GET /bigginsight/_search?size=0
{
  "query": { "term": {"customer": "Linkedin"} },
  "aggs": {
    "counts_over_time": {
      "date_histogram": {
        "field": "time",
        "interval": "1d",
        "time_zone": "+05:30"
      },
      "aggs": {
        "total_bandwidth": {
          "sum": { "field": "usage" }
        }
      }
    }
  }
}

We added a term filter to consider only one customer's data. Within the date_histogram aggregation, we nested another metric aggregation, that is, sum aggregation, to count the sum of the usage field within each bucket. This is how we will get the total data consumed each day. The following is the shortened response to the query:

{
  ..,
  "aggregations": {
    "counts_over_time": {
      "buckets": [
        {
          "key_as_string": "2017-09-23T00:00:00.000+05:30",
          "key": 1506105000000,
          "doc_count": 18892,
          "total_bandwidth": {
            "value": 265574303
          }
        },
        ...
      ]
    }
  }
}