title: How to search and group in ElasticSearch?
body: <p>I have ElasticSearch index with records like:</p>
  
  <pre><code>{
    "project" : "A",
    "updated" : &lt;date&gt;,
    "cost"    : 123
  },
  {
    "project" : "A",
    "updated" : &lt;date&gt;,
    "cost"    : 1
  },
  {
    "project" : "B",
    "updated" : &lt;date&gt;,
    "cost"    : 3
  },
  {
    "project" : "B",
    "updated" : &lt;date&gt;,
    "cost"    : 4
  },
  {
    "project" : "C",
    "updated" : &lt;date&gt;,
    "cost"    : 5
  }
  </code></pre>
  
  <p>I'm trying to draw "cost" chart by selected projects.
  Can anyone help me to build a query to get a sum of cost, grouped data by a project?
  F.e. I want to select data for projects "A" &amp; "B" and get something like:</p>
  
  <pre><code>date1 -&gt;
    projectA -&gt; sum(cost)
    projectB -&gt; sum(cost)
  date2 -&gt;
    projectA -&gt; sum(cost)
    projectB -&gt; sum(cost)
  </code></pre>
  
  <p>Have no idea how to modify this query, which extracts data for the one project:</p>
  
  <pre><code>    "query": {
        "bool": {
          "must": [
            {
              "match": {
                "project": {
                  "query": &lt;project&gt;,
                  "type": "phrase"
                }
              }
            },
            {
              "range": {
                "updated": {
                  "gte": &lt;startDate&gt;,
                  "format": "epoch_millis"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "3": {
          "date_histogram": {
            "field": "End_Time",
            "interval": "1M",
            "time_zone": "CST6CDT",
            "min_doc_count": 1
          },
          "aggs": {
            "2": {
              "sum": {
                "field": "cost"
              }
            }
          }
        }
      }
  </code></pre>
  
  <blockquote>
    <p><em>Upd:</em> Thanks guys! With your help I wrote the query:</p>
  </blockquote>
  
  <pre><code>{
    "query": {
      "bool": {
        "must": [
          {
            "range": {
              "End_Time": {
                "gte": 1485892800000,
                "format": "epoch_millis"
              }
            }
          }
        ],
        "should": [
          {
            "match": {
              "Project_Name": {
                "query": "A",
                "type": "phrase"
              }
            }
          },
          {
            "match": {
              "Project_Name": {
                "query": "B",
                "type": "phrase"
              }
            }
          }
        ]
      }
    },
    "aggs": {
      "3": {
        "date_histogram": {
          "field": "End_Time",
          "interval": "1M",
          "time_zone": "CST6CDT",
          "min_doc_count": 1
        },
        "aggs": {
          "project_agg": {
            "terms": {
              "field": "Project_ID"
            },
            "aggs": {
              "2": {
                "sum": {
                  "field": "Cost"
                }
              }
            }
          }
        }
      }
    }
  }
  </code></pre>
  
  <p>But it returns something strange:</p>
  
  <pre><code>"aggregations": {
   "3": {
    "buckets": [
      {
        "key_as_string": "2017-02-01T00:00:00.000-06:00",
        "key": 1485928800000,
        "doc_count": 17095,
        "project_agg": {
          "doc_count_error_upper_bound": 36,
          "sum_other_doc_count": 3503,
          "buckets": [
            {
              "2": {
                "value": 2536.8616891294323
              },
              "key": 834879987748,
              "doc_count": 2243
            },
            {
              "2": {
                "value": 3438.766646153458
              },
              "key": 497952557271,
              "doc_count": 1785
            },
            {
              "2": {
                "value": 13066.367076588496
              },
              "key": 1057394416300,
              "doc_count": 1736
            },
            ...
  </code></pre>
  
  <p>Here are 10 buckets for each month. I expect to see only 2 values for each project. What's wrong?</p>