elasticsearch-rollup-nyc-taxi.js

# Rollup NYC Taxi index

# Create a rollup job
# It works for the documents already and going to be indexed

PUT _xpack/rollup/job/nyc-taxi-yellow
{
    "index_pattern": "nyc-taxi-yellow-*",
    "rollup_index": "nyc-taxi-yellow_rollup",
    "cron": "*/30 * * * * ?",
    "page_size" :1000,
    "groups" : {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1h",
        "delay": "7d"
      },
      "terms": {
        "fields": ["PULocationID_t.keyword"]
      }
    },
    "metrics": [
        {
            "field": "passenger_count",
            "metrics": ["sum"]
        }
    ]
}

# Start the job

POST _xpack/rollup/job/nyc-taxi-yellow/_start

# Search upon the original index

GET nyc-taxi-yellow-*/_search
{
  "size": 0, 
  "aggs": {
    "1": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1d"
      },
      "aggs": {
        "2": {
          "sum": {
            "field": "passenger_count"
          }
        }
      }
    }
  }
}

# Search upon the rollup index

GET nyc-taxi-yellow_rollup/_rollup_search
{
  "size": 0,
  "aggs": {
    "2": {
      "sum": {
        "field": "passenger_count"
      }
    }
  }
}

GET nyc-taxi-yellow_rollup/_rollup_search
{
  "size": 0,
  "aggs": {
    "1": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1d"
      },
      "aggs": {
        "2": {
          "sum": {
            "field": "passenger_count"
          }
        }
      }
    }
  }
}

# Stop the job

POST _xpack/rollup/job/nyc-taxi-yellow/_stop

# Delete the job

DELETE _xpack/rollup/job/nyc-taxi-yellow

# Delete the rollup index

DELETE nyc-taxi-yellow_rollup