Moving avg aggregation

Moving avg aggregation #

A parent pipeline aggregation smoothing a metric with a moving average over the last N buckets — one averaged point per bucket, flattening noise so the trend underneath shows.

"smooth": {
  "moving_avg": { "buckets_path": "per_day>revenue", "window": 3 }
}

How it works #

In this engine moving_avg is evaluated in the sibling placement: declare it next to the bucket aggregation and point buckets_path at the series with the full parent>metric form. After the buckets are built, the engine slides a trailing window over their values and emits a standalone buckets array (keys 0..n−1) with one value per consumed bucket — the average of the window ending at that bucket.