title: ElasticSearch aggregation - get the exact time of a max histogram value in a timeseries
body: <p>I am quite new to elasticsearch, so apologies if this is a trivial question. </p>
  
  <p>I have a time series with irregular updates every n number of seconds that I want to plot historically.  The data contains a long variable called 'score', and a long variable with the epoch called 'time' for each 'score' as the timestamp.</p>
  
  <p>To reduce the number of points in a long timescale plot (e.g. a whole year), I want to summarize the data in 256 buckets, and use the maximum 'score' value for each bucket; however, I need to retain the original timestamp of each score, and not the beginning of the bucket.</p>
  
  <p>I managed to get the buckets by running the following query:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>curl -XGET 'http://localhost:9200/localhost.localdomain/SET_APPS/_search' -d'
  {
    "query" : {
      "range" : {
        "time" : {
          "from" : 1429010378445,
          "to" : 1431602378445,
          "include_lower" : true,
          "include_upper" : true
        }
      }
    },
    "aggregations" : {
        "time_hist" : {
          "histogram" : {
            "field" : "time",
            "interval" : 10125000,
            "order" : {
              "_count" : "asc"
            },
            "min_doc_count" : 0,
            "extended_bounds" : {
              "min" : 1429010378445,
              "max" : 1431602378445
            }
          },
          "aggregations" : {
            "max_score" : {
              "max" : {
                "field" : "score"
              }
            }
          }
        }
      }
    }
  }'</code></pre>
  </div>
  </div>
  </p>
  
  <p>However, I am only getting the bucket's timestamp, whereas I need the original time of the score:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>{
    "took": 8,
    "timed_out": false,
    "_shards": {
      "total": 5,
      "successful": 4,
      "failed": 1,
      "failures": [{
        "index": "localhost.localdomain",
        "shard": 2,
        "status": 500,
        "reason
  ": "QueryPhaseExecutionException[[localhost.localdomain][2]: query[filtered(time:[1429010378445 TO 1431602378445])-&gt;cache(_type:SET_APPS)],from[0],size
  [10]: Query Failed [Failed to execute main query]]; nested: IllegalStateException[unexpected docvalues type NONE for field 'score' (expected one of [S
  ORTED_NUMERIC, NUMERIC]). Use UninvertingReader or index with docvalues.]; "
      }]
    },
    "hits": {
      "total": 2018,
      "max_score": 1.0,
      "hits": [{
        "_index": "localhost.localdomain",
        "_type": "SET_APPS",
        "_id": "AU09dUBR80Hb_Fungv_r",
        "_score": 1.0,
        "_source": {
          time: 1431255203918,
          score: 6027
        }
      }, {
        "_index": "localhost.localdomain",
        "_type": "SET_APPS",
        "_id": "AU09c7MS80Hb_Fungv_X",
        "_score": 1.0,
        "_source": {
          time: 1431255102221,
          score: 5518,
        }
      } 
          ....
       
      ]
    },
    "aggregations": {
      "time_hist": {
        "buckets": [{
          "key": 1429002000000,
          "doc_count": 0,
          "max_score": {
            "value": null
          }
        }, 
           ......
           {
          "key": 1431249750000,
          "doc_count": 215,
          "max_score": {
            "value": 8564.0,
            "value_as_string": "8564.0"
          }
        }, {
          "key": 1431280125000,
          "doc_count": 228,
          "max_score": {
            "value": 18602.0,
            "value_as_string": "18602.0"
          }
        }, {
          "key": 1431259875000,
          "doc_count": 658,
          "max_score": {
            "value": 17996.0,
            "value_as_string": "17996.0"
          }
        }, {
          "key": 1431270000000,
          "doc_count": 917,
          "max_score": {
            "value": 17995.0,
            "value_as_string": "17995.0"
          }
        }]
      }
    }
  }</code></pre>
  </div>
  </div>
  </p>
  
  <p>In the results above, if we query specifically for score 18602, we get the real timestamp:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>$ curl -XGET 'http://localhost:9200/localhost.localdomain/SET_APPS/_search' -d'
  {
    "fields": [ "time", "score" ],
    "query" : {
      "term": {
    "score": "18602"
    }
  }
  }'
  {"took":3,"timed_out":false,"_shards":{"total":5,"successful":5,"failed":0},"hits":{"total":1,"max_score":1.0,"hits":[{"_index":"localhost.localdomain
  ","_type":"SET_APPS","_id":"AU0-90Vsi-vs_2ajcYu-","_score":1.0,"fields":{"score":[18602],"time":[1431280502124]}}]}}</code></pre>
  </div>
  </div>
  </p>
  
  <p>Any help is appreciated!</p>