Elastic Certified Engineer: Aggregations

What to know

Aggregations fall into three families. Metric aggregations (avg, sum, min, max, stats, value_count, cardinality, percentiles, top_hits, geo variants) compute numbers. Bucket aggregations (terms, date_histogram, histogram, range, filters, nested, reverse_nested, composite, significant_terms) group documents. Pipeline aggregations (derivative, cumulative_sum, moving_fn, bucket_script, bucket_selector, avg_bucket) compute over other aggregations' output. Send "size": 0 when you only want the numbers and no hits.

Traps

• A terms aggregation on a text field fails unless fielddata is enabled - aggregate on the keyword sub-field instead.
• terms counts are approximate and shard-local: read doc_count_error_upper_bound and sum_other_doc_count, and raise shard_size (or size) when precision matters.
• cardinality is approximate; raise precision_threshold (max 40,000) for small, high-accuracy sets.
• Aggregating on nested fields requires a nested aggregation with the right path; returning to parent documents needs reverse_nested.
• Pipeline aggregations reference siblings or children by name through buckets_path, and bucket_selector filters buckets, not documents.
• Paging past the first page of buckets needs composite, not terms with a large from.

Rule of thumb

Order terms buckets by a sub-aggregation ("order": {"avg_price": "desc"}) when "top by count" is not what the question means - and expect that ordering by a sub-metric sorts many more buckets in memory.