Learning Elastic Stack 6.0

Terms aggregation

Terms aggregation is probably the most widely used aggregation. It is useful for segmenting or grouping the data by a given field's distinct values. Suppose that in the network traffic data example which we have loaded, we have the following question:

Which are the top categories, that is, categories that are surfed the most by users?

We are interested in the most surfed categories, not in terms of bandwidth used but just in terms of counts (record counts). In a relational database, we could write a query like the following one:

SELECT category, count(*) FROM usageReport GROUP BY category ORDER BY count(*) DESC;

The Elasticsearch aggregation query, which would do a similar job, can be written as follows:

GET /bigginsight/usageReport/_search ...