Terms aggregation is probably the most widely used aggregation. It is useful for segmenting or grouping the data by a given field's distinct values. Suppose that, in the network traffic data example that we have loaded, we have the following question:
Which are the top categories, that is, categories that are surfed the most by users?
We are interested in the most surfed categories – not in terms of the bandwidth used, but just in terms of counts (record counts). In a relational database, we could write a query like the following:
SELECT category, count(*) FROM usageReport GROUP BY category ORDER BY count(*) DESC;
The Elasticsearch aggregation query, which would do a similar job, can be written as follows:
GET /bigginsight/_search ...
