Missing aggregation

Missing aggregation #

A single-bucket aggregation of the documents that have no indexed value for a field — the inverse of the exists query. It turns data gaps into a number you can alert on, instead of discovering them when a report quietly undercounts.

How it works #

For every document the query matched, the engine checks whether the field has an indexed value in the column store — an absent field and an explicit null both count as missing. The matching documents form one bucket shaped { "doc_count": N, …sub-aggs }; sub-aggregations run over exactly those incomplete documents, so you can ask not just how many rows are broken but how they break.