boxplot-aggregation.asciidoc 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189
  1. [role="xpack"]
  2. [testenv="basic"]
  3. [[search-aggregations-metrics-boxplot-aggregation]]
  4. === Boxplot aggregation
  5. ++++
  6. <titleabbrev>Boxplot</titleabbrev>
  7. ++++
  8. A `boxplot` metrics aggregation that computes boxplot of numeric values extracted from the aggregated documents.
  9. These values can be generated by a provided script or extracted from specific numeric or
  10. <<histogram,histogram fields>> in the documents.
  11. The `boxplot` aggregation returns essential information for making a {wikipedia}/Box_plot[box plot]: minimum, maximum,
  12. median, first quartile (25th percentile) and third quartile (75th percentile) values.
  13. ==== Syntax
  14. A `boxplot` aggregation looks like this in isolation:
  15. [source,js]
  16. --------------------------------------------------
  17. {
  18. "boxplot": {
  19. "field": "load_time"
  20. }
  21. }
  22. --------------------------------------------------
  23. // NOTCONSOLE
  24. Let's look at a boxplot representing load time:
  25. [source,console]
  26. --------------------------------------------------
  27. GET latency/_search
  28. {
  29. "size": 0,
  30. "aggs": {
  31. "load_time_boxplot": {
  32. "boxplot": {
  33. "field": "load_time" <1>
  34. }
  35. }
  36. }
  37. }
  38. --------------------------------------------------
  39. // TEST[setup:latency]
  40. <1> The field `load_time` must be a numeric field
  41. The response will look like this:
  42. [source,console-result]
  43. --------------------------------------------------
  44. {
  45. ...
  46. "aggregations": {
  47. "load_time_boxplot": {
  48. "min": 0.0,
  49. "max": 990.0,
  50. "q1": 165.0,
  51. "q2": 445.0,
  52. "q3": 725.0
  53. }
  54. }
  55. }
  56. --------------------------------------------------
  57. // TESTRESPONSE[s/\.\.\./"took": $body.took,"timed_out": false,"_shards": $body._shards,"hits": $body.hits,/]
  58. ==== Script
  59. The boxplot metric supports scripting. For example, if our load times
  60. are in milliseconds but we want values calculated in seconds, we could use
  61. a script to convert them on-the-fly:
  62. [source,console]
  63. --------------------------------------------------
  64. GET latency/_search
  65. {
  66. "size": 0,
  67. "aggs": {
  68. "load_time_boxplot": {
  69. "boxplot": {
  70. "script": {
  71. "lang": "painless",
  72. "source": "doc['load_time'].value / params.timeUnit", <1>
  73. "params": {
  74. "timeUnit": 1000 <2>
  75. }
  76. }
  77. }
  78. }
  79. }
  80. }
  81. --------------------------------------------------
  82. // TEST[setup:latency]
  83. <1> The `field` parameter is replaced with a `script` parameter, which uses the
  84. script to generate values which percentiles are calculated on
  85. <2> Scripting supports parameterized input just like any other script
  86. This will interpret the `script` parameter as an `inline` script with the `painless` script language and no script parameters. To use a
  87. stored script use the following syntax:
  88. [source,console]
  89. --------------------------------------------------
  90. GET latency/_search
  91. {
  92. "size": 0,
  93. "aggs": {
  94. "load_time_boxplot": {
  95. "boxplot": {
  96. "script": {
  97. "id": "my_script",
  98. "params": {
  99. "field": "load_time"
  100. }
  101. }
  102. }
  103. }
  104. }
  105. }
  106. --------------------------------------------------
  107. // TEST[setup:latency,stored_example_script]
  108. [[search-aggregations-metrics-boxplot-aggregation-approximation]]
  109. ==== Boxplot values are (usually) approximate
  110. The algorithm used by the `boxplot` metric is called TDigest (introduced by
  111. Ted Dunning in
  112. https://github.com/tdunning/t-digest/blob/master/docs/t-digest-paper/histo.pdf[Computing Accurate Quantiles using T-Digests]).
  113. [WARNING]
  114. ====
  115. Boxplot as other percentile aggregations are also
  116. {wikipedia}/Nondeterministic_algorithm[non-deterministic].
  117. This means you can get slightly different results using the same data.
  118. ====
  119. [[search-aggregations-metrics-boxplot-aggregation-compression]]
  120. ==== Compression
  121. Approximate algorithms must balance memory utilization with estimation accuracy.
  122. This balance can be controlled using a `compression` parameter:
  123. [source,console]
  124. --------------------------------------------------
  125. GET latency/_search
  126. {
  127. "size": 0,
  128. "aggs": {
  129. "load_time_boxplot": {
  130. "boxplot": {
  131. "field": "load_time",
  132. "compression": 200 <1>
  133. }
  134. }
  135. }
  136. }
  137. --------------------------------------------------
  138. // TEST[setup:latency]
  139. <1> Compression controls memory usage and approximation error
  140. include::percentile-aggregation.asciidoc[tags=t-digest]
  141. ==== Missing value
  142. The `missing` parameter defines how documents that are missing a value should be treated.
  143. By default they will be ignored but it is also possible to treat them as if they
  144. had a value.
  145. [source,console]
  146. --------------------------------------------------
  147. GET latency/_search
  148. {
  149. "size": 0,
  150. "aggs": {
  151. "grade_boxplot": {
  152. "boxplot": {
  153. "field": "grade",
  154. "missing": 10 <1>
  155. }
  156. }
  157. }
  158. }
  159. --------------------------------------------------
  160. // TEST[setup:latency]
  161. <1> Documents without a value in the `grade` field will fall into the same bucket as documents that have the value `10`.