Aggregations

Each shard independently returns only its own top candidate terms, and the coordinating node sums those partial lists. A term ranked low on one shard contributes nothing from it, so counts can be undercounted or the term missed entirely.

The cardinality aggregation estimates distinct counts with a HyperLogLog++ sketch of fixed size instead of tracking every value, so memory stays bounded as cardinality grows. precision_threshold trades memory for accuracy: higher means near-exact counts up to a larger unique count.

The percentiles aggregation summarizes the value distribution in a bounded TDigest sketch rather than sorting every value, so results are approximate. TDigest is most accurate at extreme percentiles and least accurate near the median, and per-shard sketches are merged.

Analyzed text fields have no doc_values, so aggregating on them makes Elasticsearch uninvert the index into heap-resident fielddata, whose size grows with token count. That risks the heap, so it is disabled by default; aggregate on a keyword sub-field instead.

buckets_path is a small path language over the aggregation tree: a name refers to an aggregation, > descends into a sub-aggregation, . picks one value from a multi-value metric, and keywords like _count and _key address the bucket itself.

A parent pipeline is declared inside the multi-bucket aggregation it processes and acts on each of its buckets, as derivative and bucket_script do. A sibling is declared beside that aggregation and returns one result over all its buckets, as avg_bucket and max_bucket do.

Read which breaker tripped from the exception: request means the aggregation's own structures, fielddata means uninverted text or ordinals, parent means cluster-wide heap pressure. Fix the query — smaller size, composite paging, narrower filter, pre-aggregation — rather than raising the limit.

The stats aggregation returns count, min, max, avg and sum for a numeric field in a single pass. extended_stats adds sum_of_squares, variance, standard deviation and standard-deviation bounds around the mean.

A pipeline aggregation consumes the output of another aggregation — its buckets or its metric values — instead of documents. It is pointed at that output with buckets_path and is computed during the reduce phase, after the source aggregation has produced results.

calendar_interval buckets by calendar units whose real length varies — months differ in length and daylight-saving days are not 24 hours — and accepts only a single unit. fixed_interval buckets by an exact multiple of milliseconds, so every bucket is identical.

Objects under a nested field are indexed as separate hidden Lucene documents. A root-level aggregation only sees root documents, which carry no values for those subfields, so it finds nothing. Wrapping it in a nested aggregation switches to that context.

value_count counts extracted field values, not documents. A multi-valued field contributes one count per array element, so a document with three tags adds three, while a document missing the field adds nothing.

size: 0 returns no documents, so Elasticsearch skips the fetch phase and only computes aggregations and the hit count. The shard request cache only stores shard-level results for such requests, making repeated identical dashboard queries nearly free until the next refresh.

A derivative subtracts consecutive buckets, so what counts as consecutive depends on which buckets came back. Metrics like avg yield no value on an empty interval, and min_doc_count above zero drops those intervals entirely, so the derivative silently spans a gap.

When you must walk every bucket rather than the top few. A terms aggregation returns only its top size buckets and offers no next page; composite streams all buckets in composite-key order and pages through them with after_key.

Elasticsearch stores dates as UTC milliseconds; time_zone makes the rounding to bucket boundaries happen in that zone instead. Day and month buckets then start at local midnight, and daylight-saving transitions make calendar day buckets 23 or 25 hours long.

Global ordinals map each segment's local keyword term numbering onto one shard-wide numbering so terms aggregations can count into integer slots instead of hashing strings. They are rebuilt lazily after each refresh; eager_global_ordinals moves that build into refresh, trading write cost for stable search latency.

Compute the value per bucket with bucket_script, then order the buckets with bucket_sort, which also takes from and size. A terms aggregation's own order clause cannot reference a pipeline aggregation, so bucket_sort is the mechanism.

bucket_selector runs during the reduce phase, after the parent aggregation has collected documents and already chosen its buckets. It only removes buckets from the response, so all the collection work and memory has already been spent, and it can never bring back a bucket the parent did not return.

Classify the consumer first: dashboards and trends tolerate estimates, invoices and audits do not. The cardinality aggregation returns no error bound, so if the number must be defensible, restructure so an exact metric answers it rather than tuning precision.

Measure which panels cost what, then shrink the input with tiering and retention, pre-aggregate the recurring analyses into summary indices, make the remaining queries cacheable, and bound the blast radius with bucket limits and workload isolation before buying heap.

init_script runs once per shard to seed a state object, map_script runs once per matching document to accumulate into it, combine_script runs once per shard to produce the value sent over the wire, and reduce_script runs once on the coordinating node over the list of shard results.

Both are single-bucket aggregations that restrict their sub-aggregations to a capped set of documents per shard — sampler keeps the top-scoring shard_size hits, diversified_sampler additionally limits how many hits share a given field value, so one prolific source cannot dominate the sample.