documents.yaml

# Some sample documents that could be data about ticket sales.
# An organization can have multiple events, and an event has ticket sales.
# Tickets can have different prices, and are of course sold at different times.

ticket_id: 1
event: red_wedding
organization: freys
sold_at: 2013-12-01T12:00
price: 400
---
ticket_id: 2
event: red_wedding
organization: freys
sold_at: 2013-12-01T12:01
price: 400
---
ticket_id: 3
event: red_wedding
organization: freys
sold_at: 2013-12-01T12:03
price: 400
---
ticket_id: 4
event: afterparty
organization: freys
sold_at: 2013-12-01T12:03
price: 600
---
ticket_id: 5
event: purple_wedding
organization: lannisters
sold_at: 2013-12-04T12:00
price: 500
---
ticket_id: 6
event: red_wedding
organization: freys
sold_at: 2013-12-04T12:00
price: 1000
---

play.sh

#!/bin/bash

export ELASTICSEARCH_ENDPOINT="http://localhost:9200"

# Create indexes

curl -XPUT "$ELASTICSEARCH_ENDPOINT/play" -d '{
    "settings": {
        "analysis": {}
    },
    "mappings": {}
}'


# Index documents
curl -XPOST "$ELASTICSEARCH_ENDPOINT/_bulk?refresh=true" -d '
{"index":{"_index":"play","_type":"type"}}
{"ticket_id":1,"event":"red_wedding","organization":"freys","sold_at":"2013-12-01T12:00","price":400}
{"index":{"_index":"play","_type":"type"}}
{"ticket_id":2,"event":"red_wedding","organization":"freys","sold_at":"2013-12-01T12:01","price":400}
{"index":{"_index":"play","_type":"type"}}
{"ticket_id":3,"event":"red_wedding","organization":"freys","sold_at":"2013-12-01T12:03","price":400}
{"index":{"_index":"play","_type":"type"}}
{"ticket_id":4,"event":"afterparty","organization":"freys","sold_at":"2013-12-01T12:03","price":600}
{"index":{"_index":"play","_type":"type"}}
{"ticket_id":5,"event":"purple_wedding","organization":"lannisters","sold_at":"2013-12-04T12:00","price":500}
{"index":{"_index":"play","_type":"type"}}
{"ticket_id":6,"event":"red_wedding","organization":"freys","sold_at":"2013-12-04T12:00","price":1000}
{"index":{"_index":"play","_type":"type"}}
{}
'

# Do searches

curl -XPOST "$ELASTICSEARCH_ENDPOINT/_search?pretty" -d '
{
    "aggregations": {
        "organization": {
            "terms": {
                "field": "organization",
                "order": {
                    "revenue.sum": "desc"
                }
            },
            "aggs": {
                "revenue": {
                    "stats": {
                        "field": "price"
                    }
                },
                "event": {
                    "terms": {
                        "field": "event",
                        "order": {
                            "_count": "desc"
                        }
                    },
                    "aggs": {
                        "sales_by_hour": {
                            "date_histogram": {
                                "field": "sold_at",
                                "interval": "hour"
                            },
                            "aggs": {
                                "price": {
                                    "extended_stats": {
                                        "field": "price"
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    },
    "size": 0
}
'

play.yaml

# Auto generated by Found's Play-tool at 2013-12-20T12:40:04+01:00
version: 0
title: Aggregating ticket sales performance
description: ""

searches.yaml

# We want to make a dashboard that lists organizations, their events and their
# ticket sales - and we want the best selling organizations on top.

# You could have a query here to narrow it to a certain time range or whatever else. :)

aggregations: 
    organization:
        terms:
            # We're interested in getting organizations
            field: organization
            order: 
                # ... specifically those that bring in a lot of revenue.
                revenue.sum: desc

        aggs: 

            # ... so we need to get the revenue to sort by it.
            revenue:
                stats: 
                    field: price

            # Then, we are also interested in the top events of those top organizations.
            event:
                terms:
                    field: event
                    # ... in this case by the number of ticket sales.
                    # Could of course be revenue as well.
                    order: 
                        _count: desc
                aggs: 
            
                    # Then we'd like to plot a time series for the sales performance for
                    # that event.
                    sales_by_hour:
                        date_histogram: 
                            field: sold_at
                            interval: hour
                        aggs: 
                            price:
                                # And not just the count, but also the revenue and the
                                # variance in price, for example.
                                extended_stats: 
                                    field: price
size: 0 # Just the aggregations!