Metric aggregation

A metric aggregation calculates a numerical summary across a set of Elasticsearch documents. Use it when individual search hits are less important than a question about the whole result set: total sales, highest deaths, lowest error count, or average rating. Common metric functions include sum, min, max, and avg. section 13.1 section 13.2

A single-value metric aggregation produces exactly one value from its input documents. For example, min, max, and avg each return one result. This differs from stats, which returns several values—such as count, min, max, average, and sum—for the same field. section 13.2 section 2.6.1

GET covid/_search
{
  "aggs": {                   #1
    "critical_patients": {    #2
      "sum": {                #3
        "field": "critical"   #4
      }
    }
  }
}

This request sums the critical field across COVID documents. The critical_patients name becomes the response key, while sum selects the calculation and field selects its input. section 2.6.1

The same pattern supports other one-number reports. Replace sum with max to find the largest field value, or use min or avg as needed. When several core statistics are needed together, prefer stats rather than issuing separate basic metric aggregations. section 2.6.1 section 13.2

GET covid/_search
{
  "size": 0, 
  "aggs": {
    "all_stats": {
      "stats": {            #1
        "field": "deaths"
      }
    }
  }
}
#1 The stats query returns all five core metrics at once.

The stats request shows the multi-value alternative: one field yields count, minimum, maximum, average, and sum rather than a single result. section 2.6.1

Metric aggregations fit into broader analytics work:

• Combine search and aggregations in one request to calculate a metric for documents selected by search criteria. section 2.6
• Use bucket aggregations when values must first be grouped into intervals, ranges, or categories. section 2.6
• Use pipeline aggregations when a calculation must consume the output of metric or bucket aggregations rather than document fields directly. section 13.5

Start with a field whose values answer the operational question, such as critical patients, deaths, sales, or ratings. A metric summarizes the selected document set; it does not replace search when the application needs the individual matching documents. For grouped or chained analysis, build on metrics with buckets or pipelines. section 2.6.1 section 13.6