You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -96,9 +100,9 @@ The response contains buckets with document counts for each filter and combinati
96
100
97
101
::::{dropdown} Properties of `filters`
98
102
`<filter>`
99
-
: (Required, [Query DSL object](/reference/query-languages/querydsl.md)) Query used to filter documents. The key is the filter name.
103
+
: (Required, [Query DSL object](query-dsl.md)) Query used to filter documents. The key is the filter name.
100
104
101
-
At least one filter is required. The total number of filters cannot exceed the [`indices.query.bool.max_clause_count`](/reference/elasticsearch/configuration-reference/search-settings.md#indices-query-bool-max-clause-count) setting. See [Filter limits](#adjacency-matrix-agg-filter-limits).
105
+
At least one filter is required. The total number of filters cannot exceed the [`indices.query.bool.max_clause_count`](search-settings.md#indices-query-bool-max-clause-count) setting. See [Filter limits](search-aggregations-bucket-adjacency-matrix-aggregation.md#adjacency-matrix-agg-filter-limits).
# Auto-interval date histogram aggregation [search-aggregations-bucket-autodatehistogram-aggregation]
8
6
9
7
10
-
A multi-bucket aggregation similar to the [Date histogram](/reference/data-analysis/aggregations/search-aggregations-bucket-datehistogram-aggregation.md) except instead of providing an interval to use as the width of each bucket, a target number of buckets is provided indicating the number of buckets needed and the interval of the buckets is automatically chosen to best achieve that target. The number of buckets returned will always be less than or equal to this target number.
8
+
A multi-bucket aggregation similar to the [Date histogram](search-aggregations-bucket-datehistogram-aggregation.md) except instead of providing an interval to use as the width of each bucket, a target number of buckets is provided indicating the number of buckets needed and the interval of the buckets is automatically chosen to best achieve that target. The number of buckets returned will always be less than or equal to this target number.
11
9
12
10
The buckets field is optional, and will default to 10 buckets if not specified.
13
11
@@ -29,12 +27,14 @@ POST /sales/_search?size=0
29
27
}
30
28
```
31
29
30
+
% TEST[setup:sales]
31
+
32
32
## Keys [_keys]
33
33
34
34
Internally, a date is represented as a 64 bit number representing a timestamp in milliseconds-since-the-epoch. These timestamps are returned as the bucket `key`s. The `key_as_string` is the same timestamp converted to a formatted date string using the format specified with the `format` parameter:
35
35
36
-
::::{tip}
37
-
If no `format` is specified, then it will use the first date [format](/reference/elasticsearch/mapping-reference/mapping-date-format.md) specified in the field mapping.
36
+
::::{tip}
37
+
If no `format` is specified, then it will use the first date [format](mapping-date-format.md) specified in the field mapping.
38
38
::::
39
39
40
40
@@ -55,7 +55,9 @@ POST /sales/_search?size=0
55
55
}
56
56
```
57
57
58
-
1. Supports expressive date [format pattern](/reference/data-analysis/aggregations/search-aggregations-bucket-daterange-aggregation.md#date-format-pattern)
58
+
% TEST[setup:sales]
59
+
60
+
1. Supports expressive date [format pattern](search-aggregations-bucket-daterange-aggregation.md#date-format-pattern)
If a `time_zone` of `-01:00` is specified, then midnight starts at one hour before midnight UTC:
187
193
188
194
```console
@@ -200,6 +206,8 @@ GET my-index-000001/_search?size=0
200
206
}
201
207
```
202
208
209
+
% TEST[continued]
210
+
203
211
Now three 1-hour buckets are still returned but the first bucket starts at 11:00pm on 30 September 2015 since that is the local time for the bucket in the specified time zone.
204
212
205
213
```console-result
@@ -230,10 +238,12 @@ Now three 1-hour buckets are still returned but the first bucket starts at 11:00
1. The `key_as_string` value represents midnight on each day in the specified time zone.
234
244
235
245
236
-
::::{warning}
246
+
::::{warning}
237
247
When using time zones that follow DST (daylight savings time) changes, buckets close to the moment when those changes happen can have slightly different sizes than neighbouring buckets. For example, consider a DST start in the `CET` time zone: on 27 March 2016 at 2am, clocks were turned forward 1 hour to 3am local time. If the result of the aggregation was daily buckets, the bucket covering that day will only hold data for 23 hours instead of the usual 24 hours for other buckets. The same is true for shorter intervals like e.g. 12h. Here, we will have only a 11h bucket on the morning of 27 March when the DST shift happens.
238
248
::::
239
249
@@ -269,6 +279,8 @@ POST /sales/_search?size=0
269
279
}
270
280
```
271
281
282
+
% TEST[setup:sales]
283
+
272
284
273
285
## Missing value [_missing_value]
274
286
@@ -291,6 +303,8 @@ POST /sales/_search?size=0
291
303
}
292
304
```
293
305
306
+
% TEST[setup:sales]
307
+
294
308
1. Documents without a value in the `publish_date` field will fall into the same bucket as documents that have the value `2000-01-01`.
# IP range aggregation [search-aggregations-bucket-iprange-aggregation]
8
6
9
7
10
-
Just like the dedicated [date](/reference/data-analysis/aggregations/search-aggregations-bucket-daterange-aggregation.md) range aggregation, there is also a dedicated range aggregation for IP typed fields:
8
+
Just like the dedicated [date](search-aggregations-bucket-daterange-aggregation.md) range aggregation, there is also a dedicated range aggregation for IP typed fields:
# Multi Terms aggregation [search-aggregations-bucket-multi-terms-aggregation]
8
6
9
7
10
-
A multi-bucket value source based aggregation where buckets are dynamically built - one per unique set of values. The multi terms aggregation is very similar to the [`terms aggregation`](/reference/data-analysis/aggregations/search-aggregations-bucket-terms-aggregation.md#search-aggregations-bucket-terms-aggregation-order), however in most cases it will be slower than the terms aggregation and will consume more memory. Therefore, if the same set of fields is constantly used, it would be more efficient to index a combined key for this fields as a separate field and use the terms aggregation on this field.
11
-
12
-
The multi_term aggregations are the most useful when you need to sort by a number of document or a metric aggregation on a composite key and get top N results. If sorting is not required and all values are expected to be retrieved using nested terms aggregation or [`composite aggregations`](/reference/data-analysis/aggregations/search-aggregations-bucket-composite-aggregation.md) will be a faster and more memory efficient solution.
8
+
A multi-bucket value source based aggregation where buckets are dynamically built - one per unique set of values. The multi terms aggregation is very similar to the [`terms aggregation`](search-aggregations-bucket-terms-aggregation.md#search-aggregations-bucket-terms-aggregation-order), however in most cases it will be slower than the terms aggregation and will consume more memory. Therefore, if the same set of fields is constantly used, it would be more efficient to index a combined key for this fields as a separate field and use the terms aggregation on this field.
9
+
10
+
The multi_term aggregations are the most useful when you need to sort by a number of document or a metric aggregation on a composite key and get top N results. If sorting is not required and all values are expected to be retrieved using nested terms aggregation or [`composite aggregations`](search-aggregations-bucket-composite-aggregation.md) will be a faster and more memory efficient solution.
1.`multi_terms` aggregation can work with the same field types as a [`terms aggregation`](/reference/data-analysis/aggregations/search-aggregations-bucket-terms-aggregation.md#search-aggregations-bucket-terms-aggregation-order) and supports most of the terms aggregation parameters.
1.`multi_terms` aggregation can work with the same field types as a [`terms aggregation`](search-aggregations-bucket-terms-aggregation.md#search-aggregations-bucket-terms-aggregation-order) and supports most of the terms aggregation parameters.
36
75
37
76
38
77
Response:
@@ -83,6 +122,8 @@ Response:
83
122
}
84
123
```
85
124
125
+
% TESTRESPONSE[s/\.\.\.//]
126
+
86
127
1. an upper bound of the error on the document counts for each term, see <<search-aggregations-bucket-multi-terms-aggregation-approximate-counts,below>
87
128
2. when there are lots of unique terms, Elasticsearch only returns the top terms; this number is the sum of the document counts for all buckets that are not part of the response
88
129
3. the list of the top buckets.
@@ -93,7 +134,7 @@ By default, the `multi_terms` aggregation will return the buckets for the top te
The following parameters are supported. See [`terms aggregation`](/reference/data-analysis/aggregations/search-aggregations-bucket-terms-aggregation.md#search-aggregations-bucket-terms-aggregation-order) for more detailed explanation of these parameters.
137
+
The following parameters are supported. See [`terms aggregation`](search-aggregations-bucket-terms-aggregation.md#search-aggregations-bucket-terms-aggregation-order) for more detailed explanation of these parameters.
97
138
98
139
size
99
140
: Optional. Defines how many term buckets should be returned out of the overall terms list. Defaults to 10.
1. Documents without a value in the `product` field will fall into the same bucket as documents that have the value `Product Z`.
277
326
278
327
279
328
280
329
## Mixing field types [_mixing_field_types]
281
330
282
-
::::{warning}
331
+
::::{warning}
283
332
When aggregating on multiple indices the type of the aggregated field may not be the same in all indices. Some types are compatible with each other (`integer` and `long` or `float` and `double`) but when the types are a mix of decimal and non-decimal number the terms aggregation will promote the non-decimal numbers to decimal numbers. This can result in a loss of precision in the bucket values.
0 commit comments