Top metrics aggregation

Top metrics aggregation #

A metrics aggregation that returns metric values from the leading matching documents — a cheaper alternative to top_hits when you only need field values, not whole documents.

Engine note: sort is accepted for compatibility; the current implementation returns the metrics of the first size matching documents.

How it works #

top_metrics walks the bucket’s documents and emits one entry per document for the first size of them, in index order. Each entry maps every configured metric field to its value in that document. The response is the flat form {"top": [{"price": 15.0}, …]}.

Nested aggregation

Nested aggregation #

A single-bucket aggregation that scopes its sub-aggregations to a nested object path. Nested field values are addressable as dotted columns, so sub-aggregations read variants.color style fields directly — counting per array element where it matters, not per parent document.

reverse_nested (only valid inside a nested aggregation) jumps back out to the parent-document scope.

How it works #

The engine returns a single bucket shaped { "doc_count": <parents>, …sub-aggs }. Sub-aggregations run over the parent documents, but the nested path’s values live in multivalue dotted columns, so a terms on variants.color buckets every array ELEMENT: over the 30 teaching products with 60 variant elements, black / white / blue each collect 20. One exception is top_hits, which is element-level here: each hit is one stored element carrying _nested: {field, offset} identity, sorted per the requested sort.

Pipeline scripts

Pipeline scripts #

Three pipeline aggregations evaluate a user-supplied script per bucket: bucket_script (compute a new metric per bucket), bucket_selector (keep/drop predicate), and moving_fn (window statistic). moving_avg is a moving_fn with a fixed averaging script. The same engine powers scripted_metric (scripts per document instead of per bucket) and the scripted value sources on the single-value metric aggs (sum, avg, min, max, value_count, cardinality), the per-hit script_fields of a search request (fetch phase), and the scripted queries — script_score, script filters, the _script sort.

Scripted metric aggregation

Scripted metric aggregation #

A metrics aggregation whose result is computed by your own scripts, in four phases, running on Pizza’s sandboxed script engine (see the script language reference).

How it works #

One state map per segment, folded once at the end:

state is a map you own — initialize it in init_script, accumulate into it in map_script. combine_script folds one segment’s state into a single value (a script that ends in a statement returns the state itself, the default when combine_script is omitted). reduce_script receives all combined values as the states array; if it is omitted, a single state passes through unchanged and several come back as an array — the parts, rather than a wrong merge. Builds without the scripting feature return null for the whole aggregation.

Children aggregation

Children aggregation #

A single-bucket aggregation that scopes its sub-aggregations to the child documents of a relation field (parent-child joins). In a corpus where parents and children share an index, it is the lens that looks at the child side while the outer query talks about parents.

How it works #

Engine note: the current implementation runs sub-aggregations over the scoped document set keyed by the relation; it does not resolve per-parent child sets.

...

Composite aggregation

Composite aggregation #

Paginated multi-source bucket aggregation: the composite key is a tuple built from several sources (a terms field, a histogram interval, a date_histogram, a geotile_grid), and pages are pulled with an after cursor. It does what a single terms cannot: group by several dimensions at once, and stream all combinations without oversizing size.

How it works #

Each entry in sources is named: { "day": { … } } binds day to one dimension of the composite key. A bucket’s key maps each source name to its value; buckets come back in ascending key order — first source most significant, values compared as numbers when both are (numbers sort before strings), as strings otherwise.