Introduction to Aggregation in elasticsearch

Posted By : Amit Patel | 31-Aug-2019

Java

Aggregations-

In ElasticSearch the aggregations' framework helps provide aggregated data based on a search query. And it's based on simple building blocks that are called aggregations, that can be composed in order to build complex summaries of the data.

An aggregation can be seen as a unit-of-work where he builds analytic information over a set of documents. The context of the execution of aggregation defines what this document set is (e.g. a top-level aggregation executes within the context of the executed query/filters or bool query of the search request)

In ElasticSearch, there are many different types of aggregations, each with its own purpose and output.

Bucketing-

Aggregations that build buckets, where all bucket is considered the key and a document criterion. When the aggregation is executed, all the buckets criteria are evaluated on every document in the context and when a criterion matches, the document is considered the relevant bucket. End of the aggregation process, we will end up with a list of buckets - where each one with a set of documents.

Metric-

Aggregations that keep track and reckon the metrics over a set of documents.

Matrix-

Aggregations that operate on multiple fields and generates a matrix result that is based on the values extracted from the requested document fields. Unlike metric and bucket aggregations.

Pipeline-

ElasticSearch aggregations that aggregate the output of other aggregations and their associated metrics.

Since effectively all bucket defines a document set(all documents included in the bucket), one can possibly associate aggregations on the bucket level, and those will execute within the context of that bucket. This is where aggregations can be nested!

Note-

In aggregation, bucketing aggregations can have sub-aggregations. And this sub-aggregations will be executed for the buckets which their parent aggregation generates. And no any hard limit of bucketing aggregations with sub-aggregations. We can compute aggregation within aggregation.

Syntax of aggregation-

"aggregations" : {

    "<aggregation_name>" : {

        "<aggregation_type>" : {

            <aggregation_body>

        },

           "aggregations" : {

               "<aggregation_name>" : {

                   "<aggregation_type>" : {

                        <aggregation_body>

                    }

              }

          } 

    }

}