|
@@ -27,6 +27,7 @@ The interesting part comes next, since each bucket effectively defines a documen
|
|
|
NOTE: Bucketing aggregations can have sub-aggregations (bucketing or metric). The sub aggregations will be computed for
|
|
|
each of the buckets their parent aggregation generates. There is not hard limit on the level/depth of nested aggregations (one can nest an aggregation under a "parent" aggregation which is itself a sub-aggregation of another highter aggregations)
|
|
|
|
|
|
+[float]
|
|
|
=== Structuring Aggregations
|
|
|
|
|
|
The following snippet captures the basic structure of aggregations:
|
|
@@ -46,6 +47,7 @@ The following snippet captures the basic structure of aggregations:
|
|
|
|
|
|
The `aggregations` object (a.k.a `aggs` for short) in the json holds the aggregations to be computed. Each aggregation is associated with a logical name that the user defines (e.g. if the aggregation computes the average price, then it'll make sense to name it `avg_price`). These logical names will also be used to uniquely identify the aggregations in the response. Each aggregation has a specific type (`<aggregation_type>` in the above snippet) and is typically the first key within the named aggregation body. Each type of aggregation define its own body, depending on the nature of the aggregation (eg. an `avg` aggregation on a specific field will define the field on which the avg will be calculated). At the same level of the aggregation type definition, one can optionally define a set of additional aggregations, though this only makes sense if the aggregation you defined is of a bucketing nature. In this scenario, the sub-aggregations you define on the bucketing aggregation level will be computed for all the buckets built by the bucketing aggregation. For example, if the you define a set of aggregations under the `range` aggregation, the sub-aggregations will be computed for each of the range buckets that are defined.
|
|
|
|
|
|
+[float]
|
|
|
==== Values Source
|
|
|
|
|
|
Some aggregations work on values extracted from the aggregated documents. Typically, the values will be extracted from a sepcific document field which is set under the `field` settings for the aggrations. It is also possible to define a `<<modules-scripting,script>>` that will generate the values (per document).
|
|
@@ -59,12 +61,36 @@ When working with scripts, the `script_lang` and `params` settings can also be d
|
|
|
|
|
|
Scripts can generate a single value or multiple values per documents. When generating multiple values, once can use the `script_values_sorted` settings to indicate whether these values are sorted or not. Internally, elasticsearch can perform optimizations when dealing with sorted values (for example, with the `min` aggregations, knowing the values are sorted, elasticsearch will skip the iterations over all the values and rely on the first value in the list to be the minimum value among all other values associated with the same document).
|
|
|
|
|
|
-include::aggregations/metrics.asciidoc[]
|
|
|
+[float]
|
|
|
+=== Metrics Aggregations
|
|
|
|
|
|
-include::aggregations/bucket.asciidoc[]
|
|
|
+The aggregations in this family compute metrics based on values extracted in one way or another from the documents that
|
|
|
+are being aggregated. The values are typically extracted from the fields of the document (using the field data), but
|
|
|
+can also be generated using scripts. Some aggregations output a single metric (e.g. `avg`) and are called `single-value
|
|
|
+metrics aggregation`, others generate multiple metrics (e.g. `stats`) and are called `multi-value metrics aggregation`.
|
|
|
+The distinction between single-value and multi-value metrics aggregations plays a role when these aggregations serve as
|
|
|
+direct sub-aggregations of some bucket aggregations (some bucket aggregation enable you to sort the returned buckets based
|
|
|
+on the metrics in each bucket).
|
|
|
|
|
|
|
|
|
+[float]
|
|
|
+=== Bucket Aggregations
|
|
|
|
|
|
+Bucket aggregations don't calculate metrics over fields like the metrics aggregations do, but instead, they create
|
|
|
+buckets of documents. Each bucket is associated with a criteria (depends on the aggregation type) that determines
|
|
|
+whether or not a document in the current context "falls" in it. In other words, the buckets effectively define document
|
|
|
+sets. In addition to the buckets themselves, the `bucket` aggregations also compute and return the number of documents
|
|
|
+that "fell in" each bucket.
|
|
|
|
|
|
+Bucket aggregations, as opposed to `metrics` aggregations, can hold sub-aggregations. These sub aggregations will be
|
|
|
+aggregated for each of the buckets created by their "parent" bucket aggregation.
|
|
|
+
|
|
|
+There are different bucket aggregators, each with a different "bucketing" strategy. Some define a single bucket, some
|
|
|
+define fixed number of multiple buckets, and others dynamically create the buckets during the aggregation process.
|
|
|
+
|
|
|
+
|
|
|
+include::aggregations/metrics.asciidoc[]
|
|
|
+
|
|
|
+include::aggregations/bucket.asciidoc[]
|
|
|
|
|
|
|