How can I compare 2 periods with ElasticSearch and Kibana?

Question

I'd like to compare the same value over 2 periods so that I can then write a script that calculates the percentage difference. My data looks like this:

{
"type": "Redemption",
"@timestamp": "2016-08-05T16:12:55.594909118+01:00",
"points": 1109,
"value": 5.545
}

My query looks like this:

{
    "aggs" : {
        "points_per_week" : {
            "date_histogram" : {
                "field" : "@timestamp",
                "interval" : "week",
                "format" : "yyyy-MM-dd"
            },
            "aggs": {
                "total_points": {
                    "sum": {
                        "field": "points"
                    }
                },
                "points_last_week": {
                  "date_histogram" : {
                      "field" : "@timestamp",
                      "interval" : "week",
                      "format" : "yyyy-MM-dd",
                      "offset":"-1w"
                  },
                  "aggs": {
                      "total_points": {
                          "sum": {
                              "field": "points"
                          }
                      }
                  }
                }

            }

        }
    }
}

However, the results looks like this:

"points_per_week": {
         "buckets": [
            {
               "key_as_string": "2016-02-01",
               "key": 1454284800000,
               "doc_count": 8335,
               "total_points": {
                  "value": 12537515
               },
               "points_last_week": {
                  "buckets": [
                     {
                        "key_as_string": "2016-02-05",
                        "key": 1454630400000,
                        "doc_count": 8335,
                        "total_points": {
                           "value": 12537515
                        }
                     }
                  ]
               }
            },

and it looks like it's getting the current week, but not the last one... is there a way to do it?

Answer 1

It's an old issue, but just in case someone will find it as me It can be achivied by https://www.elastic.co/guide/en/kibana/current/timelion-create.html Timelian and offset feature

.es(offset=-1h,index=metricbeat-*, timefield='@timestamp', metric='avg:system.cpu.user.pct').label('last hour'), .es(index=metricbeat-*, timefield='@timestamp', metric='avg:system.cpu.user.pct').label('current hour')

Try to take look on Timelion: The time series composer for Kibana https://www.elastic.co/blog/timelion-timeline