Global aggregation

Global aggregation #

A single-bucket aggregation whose nested aggregations run over all documents in the search context, ignoring the query scope. It is the baseline column of every analytic table: “this slice” next to “the whole dataset”, computed in the same request instead of a second round-trip.

How it works #

Normally an aggregation sees only the documents the query matched. global detaches its sub-aggregations from that scope: the engine takes the exact set of live documents — visibility and tombstones honored, per segment — and aggregates over that instead. The result is one bucket shaped { "doc_count": <all live docs>, …sub-aggs }; the aggregation itself takes no parameters beyond its sub-aggregations.