Elasticsearch Elasticsearch Multiple Aggregations: A Comprehensive Guide

By Opster Team

Updated: Jul 23, 2023

| 2 min read

Introduction

Aggregations in Elasticsearch are a powerful way to analyze and summarize your data. They allow you to group and extract statistics from your data in real-time, providing insights that can help you make informed decisions. In this article, we will explore how to use multiple aggregations in Elasticsearch to gain deeper insights into your data.

1. Understanding Multiple Aggregations

Multiple aggregations in Elasticsearch involve combining two or more aggregation types to create complex data summaries. These can be nested within each other or combined in a single request to provide a more comprehensive view of your data.

2. Types of Aggregations

There are several types of aggregations available in Elasticsearch, including:

• Bucket Aggregations: These group documents into buckets based on specified criteria, such as terms, ranges, or filters.
• Metric Aggregations: These calculate metrics, such as the sum, average, or count, for each document in a bucket.
• Pipeline Aggregations: These perform additional calculations on the results of other aggregations, such as derivatives or moving averages.

3. Combining Multiple Aggregations

To combine multiple aggregations in Elasticsearch, you can either nest them within each other or include them in a single request. Here’s how to do both:

A. Nesting Aggregations

Nesting aggregations involves placing one aggregation inside another. This is useful when you want to perform a secondary aggregation on the results of a primary aggregation. For example, you can use a terms aggregation to group documents by a specific field and then use a sub-aggregation to calculate the average value of another field within each group.

Here’s an example of a nested aggregation that groups documents by the “category” field and calculates the average price within each category:

GET /products/_search
{
  "size": 0,
  "aggs": {
    "categories": {
      "terms": {
        "field": "category.keyword"
      },
      "aggs": {
        "average_price": {
          "avg": {
            "field": "price"
          }
        }
      }
    }
  }
}

B. Combining Aggregations in a Single Request

You can also include multiple aggregations in a single request by adding them as separate objects within the “aggs” field. This is useful when you want to perform multiple, unrelated aggregations on your data.

Here’s an example that combines a terms aggregation and a range aggregation in a single request:

GET /products/_search
{
  "size": 0,
  "aggs": {
    "categories": {
      "terms": {
        "field": "category.keyword"
      }
    },
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 50 },
          { "from": 50, "to": 100 },
          { "from": 100 }
        ]
      }
    }
  }
}

4. Using Pipeline Aggregations

Pipeline aggregations allow you to perform additional calculations on the results of other aggregations. They can be used to calculate derivatives, moving averages, or other advanced metrics.

Here’s an example that uses a date_ histogram aggregation to group documents by month and then calculates the moving average of the “price” field over a three-month window:

GET /products/_search
{
  "size": 0,
  "aggs": {
    "sales_per_month": {
      "date_histogram": {
        "field": "date",
        "calendar_interval": "month"
      },
      "aggs": {
        "total_sales": {
          "sum": {
            "field": "price"
          }
        },
        "moving_average": {
          "moving_avg": {
            "buckets_path": "total_sales",
            "window": 3
          }
        }
      }
    }
  }
}

Conclusion

Multiple aggregations in Elasticsearch provide a powerful way to analyze and summarize your data. By combining different aggregation types, nesting them within each other, or using pipeline aggregations, you can gain deeper insights into your data and make more informed decisions. Experiment with different combinations of aggregations to find the best approach for your specific use case.