Aggregations

Key points

• An aggregation summarises whatever the query matched, and travels in the same request as the hits.
• Bucket aggregations group documents; metric aggregations compute a number per group.
• Set "size": 0 when you only want the numbers - it skips the fetch phase completely.
• A terms aggregation returns the top 10 by default and is approximate across shards.
• doc_count_error_upper_bound quantifies that error; raise shard_size to shrink it.
• cardinality is a HyperLogLog++ estimate, exact only below the default threshold of 3000.

Example

GET /articles/_search
{
  "size": 0,
  "query": { "term": { "status": "published" } },
  "aggs": {
    "by_tag": {
      "terms": { "field": "tags", "size": 10 },
      "aggs": { "avg_reads": { "avg": { "field": "read_count" } } }
    }
  }
}

Filter first, use size 0 when you want only numbers, and treat terms counts as approximate.