Reference · Cheat sheet

Aggregations

The compressed essence. Print it, pin it.

From lesson 0007See also glossary

Three families

Family	Does	Examples
metric	a value over the docs	`avg`, `sum`, `min`, `max`, `stats`, `cardinality`
bucket	group docs into buckets (each has `doc_count`)	`terms`, `range`, `histogram`, `date_histogram`
pipeline	input from other aggs, not docs	`avg_bucket`, `derivative`

Rules

Scope: aggs run over the query-matched docs. No query → whole index. Combine with bool to summarize a filtered subset.
Only aggs: set top-level "size": 0 to drop hits and return aggregations only.
Nest to drill down: put an agg inside a bucket's own aggs → per-bucket metrics / sub-buckets.
Aggregate on keyword, not text (text is tokenized; disabled unless costly fielddata).
terms counts are approximate across shards — check doc_count_error_upper_bound and sum_other_doc_count. Default size = 10.

Shape: group then measure

GET /idx/_search
{
  "size": 0,
  "query": { "bool": { "filter": { "range": { "year": { "gte": 2020 } } } } },
  "aggs": {
    "by_status": {                       // bucket
      "terms": { "field": "status" },
      "aggs": {
        "avg_views": { "avg": { "field": "views" } }   // metric per bucket
      }
    }
  }
}

← lesson 0007 · Source: Aggregations reference