Rare terms aggregation

Rare terms aggregation #

A multi-bucket aggregation that keeps only RARE terms — bucket keys whose document count is at or below max_doc_count. The mirror image of terms for finding the long tail: instead of the top-N most frequent values, it returns every low-frequency value.

How it works #

Bucketing works exactly like terms: one bucket per unique value of field, multi-valued fields counted per element, and documents without the field either skipped or folded into a missing bucket. include/exclude filter candidate keys up front (exact-value arrays or a single wildcard string prefix* / *suffix).