What is the difference between a bucket aggregation and a metric aggregation in Elasticsearch?
Understand the difference between bucket and metric aggregations in Elasticsearch, how they nest, with clear examples and common interview questions.
Expected Interview Answer
A bucket aggregation groups documents into buckets based on a criterion (a term, a range, a date interval), while a metric aggregation computes a numeric value such as a sum, average, or count over a set of documents.
Bucket aggregations answer "how should I group the data?" — terms, range, date_histogram, and filters each partition documents into buckets, and every bucket carries a doc_count. Metric aggregations answer "what number do I want?" — avg, sum, min, max, stats, and cardinality reduce a set of documents to one or more values. The two are almost always combined: metric aggregations are nested inside bucket aggregations so you compute a statistic per bucket, for example the average order value within each product category. Bucket aggregations can also contain other bucket aggregations for multi-level grouping.
- Bucket: partitions documents into meaningful groups
- Metric: reduces documents to numbers like avg and sum
- Nesting metrics in buckets gives per-group statistics
- Bucket-in-bucket enables multi-level drill-downs
- Together they express most analytics in one query
AI Mentor Explanation
Sorting players into batters, bowlers, and all-rounders is a bucket step; each pile is a group. Then computing each pile's average strike rate is the metric step. The grouping decides the piles, the metric squeezes each pile into one number, exactly how bucket and metric aggregations divide labor in Elasticsearch.
Step-by-Step Explanation
Step 1
Pick the grouping
Choose a bucket aggregation such as terms, range, or date_histogram to partition documents.
Step 2
Understand doc_count
Each bucket automatically reports how many documents fell into it.
Step 3
Nest a metric
Place a metric aggregation like avg or sum inside the bucket to compute a per-group number.
Step 4
Layer buckets if needed
Nest another bucket aggregation for multi-level grouping before the final metric.
Step 5
Read per-bucket results
Each bucket in the response carries its key, doc_count, and any nested metric values.
What Interviewer Expects
- Bucket groups documents; metric reduces them to numbers
- Examples of each: terms/date_histogram vs avg/sum/cardinality
- That metrics are typically nested inside buckets
- Awareness that buckets can nest inside buckets for drill-downs
Common Mistakes
- Calling a terms aggregation a metric aggregation
- Trying to compute an average without nesting it in a bucket for per-group results
- Forgetting that every bucket already provides a doc_count
- Assuming cardinality is exact rather than an approximation
Best Answer (HR Friendly)
“A bucket aggregation sorts records into groups, like piles by category, while a metric aggregation turns a set of records into a number, like an average or total. You usually put a metric inside a bucket to get one number per group.”
Code Example
GET /sales/_search
{
"size": 0,
"aggs": {
"by_region": {
"terms": { "field": "region.keyword" },
"aggs": {
"total_revenue": { "sum": { "field": "amount" } }
}
}
}
}Follow-up Questions
- Name three bucket aggregations and three metric aggregations.
- Can a bucket aggregation contain another bucket aggregation?
- How is the cardinality metric implemented under the hood?
- What does doc_count represent in a bucket?
- How would you get the average value per day over a month?
MCQ Practice
1. Which of these is a bucket aggregation?
date_histogram groups documents into time-interval buckets; the others are metric aggregations.
2. To get an average per group, you should?
Nesting a metric like avg inside a bucket aggregation yields one computed value per bucket.
3. What does every bucket automatically include?
Each bucket reports doc_count, the number of documents that fell into it, without any extra metric.
Flash Cards
Bucket aggregation? — Groups documents into buckets by a criterion like term, range, or date interval.
Metric aggregation? — Reduces a set of documents to a number such as sum, avg, min, max, or cardinality.
How are they combined? — Metrics are nested inside buckets to compute a statistic per group.
What is doc_count? — The number of documents contained in a given bucket, provided automatically.
Continue Learning
Related Interview Questions
What are aggregations in Elasticsearch and what can they do?
medium
What is the difference between keyword and text field types in Elasticsearch?
medium
What is the difference between filter context and query context in Elasticsearch?
medium
What is a bool query in Elasticsearch and how do must, should, must_not, and filter work?
medium