Moving fn aggregation

Moving fn aggregation #

A parent pipeline aggregation computing a window statistic over the last N buckets’ metrics — MovingFunctions.max(values), MovingFunctions.sum(values), MovingFunctions.min(values) and friends, with the window sliding bucket by bucket.

"smooth": {
  "moving_fn": {
    "buckets_path": "revenue",
    "window": 3,
    "script": "MovingFunctions.max(values)"
  }
}

How it works #

moving_fn is declared inside the multi-bucket aggregation it decorates, next to the metric it consumes. After the buckets are built, the engine slides a trailing window over their values and, for each bucket, evaluates the script once with the window exposed as values — a floating-point array, oldest first, current bucket last. The script’s numeric result is attached to that bucket under the pipeline’s own name.