String stats aggregation

String stats aggregation #

A multi-value metrics aggregation computing length and character statistics over keyword/string values: count, min/max/avg length and Shannon entropy of the character distribution.

How it works #

Every document that has a string value for the field contributes one string. Over those strings the engine reports:

• count — how many values were seen (documents without the field are skipped, not counted);
• min_length, max_length, avg_length — length statistics in UTF-8 bytes, so a non-ASCII character counts as its encoded width;
• entropy — Shannon entropy of the pooled character frequencies, in bits: -Σ p(c) · log2 p(c) over the share p(c) of each character across all strings. Constant text gives 0; text where every character is equally likely gives log2(alphabet size).

The character frequencies are pooled across all contributing values before the entropy is taken, so repetition across documents counts: the teaching type field repeats the same few words 120 times and still scores ≈3.22 bits.

Global aggregation

Global aggregation #

A single-bucket aggregation whose nested aggregations run over all documents in the search context, ignoring the query scope. It is the baseline column of every analytic table: “this slice” next to “the whole dataset”, computed in the same request instead of a second round-trip.

How it works #

Normally an aggregation sees only the documents the query matched. global detaches its sub-aggregations from that scope: the engine takes the exact set of live documents — visibility and tombstones honored, per segment — and aggregates over that instead. The result is one bucket shaped { "doc_count": <all live docs>, …sub-aggs }; the aggregation itself takes no parameters beyond its sub-aggregations.

Matrix stats aggregation

Matrix stats aggregation #

A multi-value metrics aggregation computing counts, means, variances, skewness, kurtosis and the correlation matrix across several numeric fields at once.

How it works #

The aggregation works row-wise: a document contributes a row only if it has a value for every listed field (a missing map can fill gaps per field). Documents with any gap are dropped entirely — the reported count is the number of complete rows, and every statistic uses the same rows. At least two rows are required; below that the result is empty.

Moving fn aggregation

Moving fn aggregation #

A parent pipeline aggregation computing a window statistic over the last N buckets’ metrics — MovingFunctions.max(values), MovingFunctions.sum(values), MovingFunctions.min(values) and friends, with the window sliding bucket by bucket.

"smooth": {
  "moving_fn": {
    "buckets_path": "revenue",
    "window": 3,
    "script": "MovingFunctions.max(values)"
  }
}

How it works #

moving_fn is declared inside the multi-bucket aggregation it decorates, next to the metric it consumes. After the buckets are built, the engine slides a trailing window over their values and, for each bucket, evaluates the script once with the window exposed as values — a floating-point array, oldest first, current bucket last. The script’s numeric result is attached to that bucket under the pipeline’s own name.

Missing aggregation

Missing aggregation #

A single-bucket aggregation of the documents that have no indexed value for a field — the inverse of the exists query. It turns data gaps into a number you can alert on, instead of discovering them when a report quietly undercounts.

How it works #

For every document the query matched, the engine checks whether the field has an indexed value in the column store — an absent field and an explicit null both count as missing. The matching documents form one bucket shaped { "doc_count": N, …sub-aggs }; sub-aggregations run over exactly those incomplete documents, so you can ask not just how many rows are broken but how they break.

Moving avg aggregation

Moving avg aggregation #

A parent pipeline aggregation smoothing a metric with a moving average over the last N buckets — one averaged point per bucket, flattening noise so the trend underneath shows.

"smooth": {
  "moving_avg": { "buckets_path": "per_day>revenue", "window": 3 }
}

How it works #

In this engine moving_avg is evaluated in the sibling placement: declare it next to the bucket aggregation and point buckets_path at the series with the full parent>metric form. After the buckets are built, the engine slides a trailing window over their values and emits a standalone buckets array (keys 0..n−1) with one value per consumed bucket — the average of the window ending at that bucket.

T-test aggregation

T-test aggregation #

A single-value metrics aggregation for a Student’s t-test over two numeric fields. Positive values mean a tends to be larger than b.

How it works #

The engine collects every value of a.field and every value of b.field across the bucket’s documents — the two samples grow independently, so a document missing one field still contributes to the other sample — and computes Welch’s two-sample t-statistic:

Bucket script aggregation

Bucket script aggregation #

A parent pipeline aggregation computing arithmetic on a bucket’s own metrics — the script references sibling metrics by name through params and its result becomes a new per-bucket value. It is the SQL SELECT a / b AS c of the aggregation world: one derived column, evaluated once per bucket over values the bucket already holds.

"avg_order": {
  "bucket_script": {
    "buckets_path": { "r": "revenue", "n": "orders" },
    "script": "params.r / params.n"
  }
}

How it works #

bucket_script is declared inside the multi-bucket aggregation it decorates, next to the metrics it consumes. After the buckets are built, the engine resolves each named path against every bucket, binds the numbers into the script’s scope, evaluates the script once, and inserts its result under the pipeline’s own name — the response shape buckets[i].avg_order.value.

Rate aggregation

Rate aggregation #

A single-value metrics aggregation that reduces a numeric field inside date_histogram buckets (per-interval totals), intended for counters that accumulate over time.

How it works #

rate reads one field and reduces it per bucket, with three reduction modes selected by mode:

• sum (default) — the bucket’s total of the field; identical to sum.
• value_count — how many values the field has in the bucket.
• avg — the bucket’s mean of the field.

If field is omitted entirely, the aggregation counts the documents in the bucket (the value_count shape over _doc).

Sampler aggregation

Sampler aggregation #

A single-bucket aggregation that keeps only a sample of the matching documents before running its sub-aggregations — used to cut aggregation cost on very large result sets. If a terms aggregation over millions of documents is too slow or too memory-hungry, sampling trades exact counts for an order-of-magnitude answer at a fraction of the cost.

How it works #

The sampler keeps the first shard_size matching documents (default 100) and discards the rest; its sub-aggregations then run over that sample only. The result is a single bucket keyed sample, carrying the sample’s doc_count and the sub-aggregation results: