Learning Elastic Stack 6.0

Bucket aggregations

The grouping of documents by a common criteria is called bucketing. Bucketing is very similar to the GROUP BY functionality in SQL. Depending on the aggregation type, each bucket is associated with a criterion which determines whether or not a document in the current context belongs to the bucket or not. Each bucket provides the information about the total number of documents it contains.

Bucket aggregations can do the following:

• Given an employee index containing employee documents
• Find the number of employees based on their age group or location
• Given the Apache access logs index, find the number of 404 responses by country

Bucket aggregation supports sub aggregations, that is, given a bucket, all the documents present ...