13 Aggregations

 

This chapter covers

  • Aggregation basics
  • Working with metric aggregations
  • Categorizing data using bucket aggregations
  • Chaining metric and bucket aggregations in pipeline aggregations

Search and analytics are two sides of a coin, and Elasticsearch delivers absolute detail and countless features. Elasticsearch is a market leader in analytics by providing feature-rich functions for querying and analyzing data, thus enabling organizations to find insights and deep intelligence from their data. Whereas a search finds results for certain criteria, analytics, on the other hand, helps organizations derive statistics and metrics from it. So far, we’ve looked at searching for documents from a given corpus of documents. With analytics, we take a step back and examine the data from a high level to draw conclusions about it.

In this chapter, we look at Elasticsearch’s aggregations in detail. Elasticsearch boasts many aggregations, predominantly categorized as one of these types: metric, bucket, and pipeline. Metric aggregations allow us to use analytical functions such as sum, min, max, and avg to perform calculations on data. Bucket aggregations help us categorize data into buckets or ranges. Finally, pipeline aggregations permit us to chain aggregations: that is take metric or bucket aggregations and create new aggregations.

13.1 Overview

13.1.1 The endpoint and syntax

13.1.2 Combining searches and aggregations

13.1.3 Multiple and nested aggregations

13.1.4 Ignoring results

13.2 Metric aggregations

13.2.1 Sample data

13.2.2 The value_count metric

13.2.3 The avg metric

Summary