This document provides examples of using aggregations in Elasticsearch to calculate statistics and group documents. It shows terms, range, and histogram facets/aggregations to group documents by fields like state or population range and calculate statistics like average density. It also demonstrates nesting aggregations to first group by one field like state and then further group and calculate stats within each state group. Finally it lists the built-in aggregation bucketizers and calculators available in Elasticsearch.
1. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
Introduction to Aggregations
2. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
facets (elasticsearch < 1.0)
facets
3. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
out-of-the-box facets
(elasticsearch < 1.0)
• terms
• range
• histogram / date histogram
• filter/query
• statistical
• geo distance
4. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
terms facet
• Divides documents into buckets based on a value
of a selected term
• Calculates statistics on some other field of these
document for each bucket
5. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
index of large US cities
{
"rank": "21",
"city": "Boston",
"state": "MA",
"population2012": "636479",
"population2010": "617594",
"land_area": "48.277",
"density": "12793",
"ansi": "619463",
"location": {
"lat": "42.332",
"lon": "71.0202"
}
}
6. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
example: terms facet request
$ curl -XGET "localhost:9200/test-data/cities/_search?pretty" -d '{
"facets": {
"stat1": {
"terms_stats": {
"key_field": "state",
"value_field": "density"
}
}
}
}'
group by
this field
calculate stats
for this field
8. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
example: range facet request
curl -XGET "localhost:9200/test-data/cities/_search?pretty" -d '{
"facets": {
"population_ranges": {
"histogram": {
"key_field": "population2012",
"value_field": "density",
"interval": 500000
}
}
}
}'
group by
this field
calculate stats
by this field
10. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
nt an average density by population histogram
11. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
aggregations
Buckets Calculators
13. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
aggregations = buckets + calculators
CA
TX
MA
CO
AZ
14. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
example: density by state aggregation
$ curl -XGET "localhost:9200/test-data/cities/_search?pretty" -d '{
"aggs" : {
"mean_density_by_state" : {
"terms" : {
"field" : "state"
},
"aggs": {
"mean_density": {
"avg" : {
"field" : "density"
}
}
}
}
}
}'
group by
this field
calculate stats
for this field
18. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
example: density by population by state
$ curl -XGET "localhost:9200/test-data/cities/_search?pretty" -d '{
"aggs" : {
"mean_density_by_population_by_state": {
"terms" : { "field" : "state" },
"aggs": {
"mean_density_by_population" : {
"histogram" : {
"field" : "population2012",
"interval": 500000
},
"aggs": {
"mean_density": {
"avg" : {
"field" : "density"
}
}
}
}
}
}
}
}'
group by
population
calculate stats
on density
group by
state
20. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
out-of-the-box aggregation calculators
(elasticsearch >= 1.0)
• avg
• min
• max
• sum
• count
• stats
• extended stats
21. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
out-of-the-box aggregation bucketizers
(elasticsearch >= 1.0)
• global
• filter
• missing
• terms
• range
• date range
• ip range
• histogram
• date histogram
• geo distance
• nested
22. Copyright Elasticsearch 2013. Copying, publishing and/or distributing without written permission is strictly
aggregations 2.0 (aka bucket reducers)
(elasticsearch 2.0)
apply arbitrary functions on buckets
• first derivative
• second derivative
• exponential weighted moving average
• outlier detection
