Learning Elastic Stack 6.0

Histogram aggregation

Histogram aggregation can slice the data into different buckets based on one numeric field. The range of each slice, also called the interval, can be specified in the input of the query.

We have records of network traffic usage data. The usage field has the number of bytes used for uploading or downloading data. Let us try to divide or slice all the data based on the usage:

POST /bigginsight/_search?size=0{  "aggs": {    "by_usage": {      "histogram": {        "field": "usage",        "interval": 1000      }    }  }}

The above aggregation query will slice all the data into the following buckets:

• 0 to 999: All records that have usage >= 0 and < 1000 will fall into this bucket
• 1,000 to 1,999: All records that have usage >= 1000 and < 2000 will fall ...