What are aggregations in Elasticsearch and what can they do?
Learn what Elasticsearch aggregations are, the bucket, metric and pipeline families, how to nest them, plus examples and common interview questions.
Expected Interview Answer
Aggregations are Elasticsearch's analytics framework that summarize, group, and compute statistics over the documents matching a query, turning raw search results into insights like counts, averages, histograms, and nested breakdowns.
Unlike a plain search that returns individual hits, an aggregation runs over the result set and builds analytic structures. The main families are bucket aggregations (which group documents into buckets, e.g. by term or date range), metric aggregations (which compute numbers like sum, avg, min, max, cardinality), and pipeline aggregations (which operate on the output of other aggregations). Aggregations can be nested arbitrarily, so you can bucket by category, then by month, then compute an average price inside each — all in one request. They typically run best on doc_values-backed keyword and numeric fields rather than analyzed text.
- Turn search results into real-time analytics and dashboards
- Group data into buckets by term, range, or date
- Compute metrics like sum, average, and cardinality
- Nest aggregations for multi-level breakdowns
- Combine filtering and analytics in a single query
AI Mentor Explanation
Aggregations are like a match analyst who takes the full scorecard and produces summaries instead of ball-by-ball rows: total runs per batter, average strike rate per over, and boundaries grouped by bowler. Each grouping is a bucket and each computed figure is a metric, all derived from the same innings in one pass.
Step-by-Step Explanation
Step 1
Match the documents
Run a query (or match_all) so the aggregation operates only over the relevant result set.
Step 2
Choose a bucket aggregation
Group documents, for example a terms aggregation on a keyword field or a date_histogram on a timestamp.
Step 3
Add a metric aggregation
Nest a sum, avg, min, max, or cardinality metric inside each bucket to compute numbers.
Step 4
Nest further if needed
Place sub-aggregations inside buckets for multi-level breakdowns like category then month.
Step 5
Read the aggregations block
Parse the response's aggregations section rather than the hits array to get the analytics.
What Interviewer Expects
- Aggregations summarize over a result set, unlike plain search hits
- The bucket vs metric vs pipeline families
- That aggregations can be nested for multi-level analytics
- Awareness that doc_values on keyword/numeric fields power aggregations efficiently
Common Mistakes
- Aggregating directly on analyzed text fields instead of keyword sub-fields
- Confusing the hits array with the aggregations block in the response
- Ignoring the performance cost of high-cardinality terms aggregations
- Thinking aggregations return documents rather than computed summaries
Best Answer (HR Friendly)
“Aggregations are Elasticsearch's way of summarizing data instead of just listing matching records. They let you group results into buckets and compute numbers like totals and averages, which is what powers real-time dashboards and analytics.”
Code Example
GET /orders/_search
{
"size": 0,
"aggs": {
"by_category": {
"terms": { "field": "category.keyword" },
"aggs": {
"avg_price": { "avg": { "field": "price" } }
}
}
}
}Follow-up Questions
- What is the difference between a bucket and a metric aggregation?
- How does the terms aggregation handle high-cardinality fields?
- What are pipeline aggregations used for?
- Why do aggregations rely on doc_values?
- How would you compute unique visitor counts efficiently?
MCQ Practice
1. Which aggregation family groups documents into sets you can drill into?
Bucket aggregations group documents into buckets; metric aggregations compute numbers over them.
2. To return only analytics with no document hits, you set?
Setting size to 0 skips returning hits so only the aggregations block comes back, saving work.
3. Which is a metric aggregation?
avg computes a numeric statistic; terms, date_histogram, and filters are bucket aggregations.
Flash Cards
What is an aggregation? — An analytics operation that summarizes the documents matching a query into counts, buckets, and metrics.
Three aggregation families? — Bucket (group), metric (compute numbers), and pipeline (operate on other aggregations' output).
Why size: 0 with aggregations? — It suppresses individual hits so only the aggregated analytics are returned.
What backs fast aggregations? — doc_values on keyword and numeric fields, a columnar on-disk structure.
Continue Learning
Related Interview Questions
What is the difference between a bucket aggregation and a metric aggregation in Elasticsearch?
medium
What is the difference between keyword and text field types in Elasticsearch?
medium
What is the difference between filter context and query context in Elasticsearch?
medium
What is a bool query in Elasticsearch and how do must, should, must_not, and filter work?
medium