Pipeline aggregations #

Aggregations over other aggregations’ output. Two shapes: sibling pipelines (declared next to a bucket aggregation, addressed by buckets_path like "per_day>revenue") compute a statistic across its buckets; parent pipelines (declared inside a bucket aggregation’s aggs) transform each bucket — running totals, derivatives, window statistics, per-bucket arithmetic.

Every pipeline takes buckets_path (the consumed metric path) and most accept gap_policy (skip default / insert_zeros) plus format.

graph LR subgraph sibling["sibling — declared beside the histogram"] B1("per_day
date_histogram") --> R1("revenue
per bucket") R1 -.->|"buckets_path:
per_day>revenue"| AVG["avg_bucket —
one number across all buckets"] end subgraph parent["parent — declared inside the histogram's aggs"] B2("per_day
date_histogram") --> R2("revenue
per bucket") R2 -.->|"each bucket in turn"| CS["cumulative_sum —
a running total per bucket"] end

Sibling pipelines — a statistic across buckets #

• Min bucket, Max bucket — the extreme bucket
• Sum bucket, Avg bucket — total / mean of the per-bucket values
• Stats bucket, Extended stats bucket — their stats families
• Percentiles bucket — distribution across buckets

Parent pipelines — transform each bucket #

• Derivative — change from the previous bucket
• Serial diff — difference lag buckets back
• Cumulative sum, Cumulative cardinality — running totals
• Moving fn, Moving avg — window statistics (MovingFunctions.*)
• Bucket script — arithmetic over sibling metrics
• Bucket selector — filter the bucket list by predicate
• Bucket sort — sort and paginate the bucket list
• Normalize — rescale to share, rank, z-score

The scripted pipelines — bucket_script, bucket_selector, moving_fn — evaluate sandboxed Rhai expressions with the MovingFunctions.* helpers built in; see pipeline scripts.

No SQL twins: pipeline aggregations are DSL-only in the current SQL subset — GROUP BY output cannot be fed into a second stage yet.