Metric aggregations #

Compute values from fields: single-value metrics, multi-value statistics, geospatial metrics and document pickers.

Single-value metrics #

• Avg, Min, Max, Sum — the basics over numeric fields
• Value count — how many values the field carries
• Cardinality — count of distinct values
• Rate — rate of change over a time field

Multi-value statistics #

• Stats — count, min, max, avg, sum in one
• Extended stats — plus variance, std-deviation, bounds
• Percentiles, Percentile ranks — the distribution’s shape
• Median absolute deviation — robust spread
• Boxplot — quartiles per field
• String stats — length distribution of string fields
• Matrix stats — covariance / correlation between fields
• T-test — hypothesis test between two samples
• Weighted average — average with a per-document weight

Geospatial metrics #

• Geo bounds — bounding box of the points
• Geo centroid — the mean point

Document pickers and scripting #

• Top hits — the best documents per bucket
• Top metrics — a field value from the top document
• Scripted metric — your script computes the metric

Scripted value sources #

The single-value metrics — sum, avg, min, max, value_count, cardinality — accept a script instead of a field, in either wire form:

{ "sum":  { "script": "doc['amount'].value * 2" } }
{ "avg":  { "script": { "source": "doc.price.value * params.factor",
                        "params": { "factor": 2 } } } }

field and script are mutually exclusive. The script runs per matching document with doc and params in scope — the same doc-values shape as scripted_metric, and the same script language. A document missing a referenced field fails the aggregation (guard with "price" in doc); missing applies to the field path only. At roughly 2 µs per document per script, prefer a plain field agg whenever the value exists.