Bucket aggregations (terms, histogram) in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of a terms aggregation query

What is the output of this Elasticsearch aggregation query on an index with documents containing a category field?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "category_counts": {
      "terms": {
        "field": "category.keyword",
        "size": 3
      }
    }
  }
}

A {"aggregations":{"category_counts":{"buckets":[{"key":"books","doc_count":5},{"key":"electronics","doc_count":3},{"key":"clothing","doc_count":2}]}}}

B {"aggregations":{"category_counts":{"buckets":[{"key":"books","doc_count":2},{"key":"electronics","doc_count":3},{"key":"clothing","doc_count":5}]}}}

C {"aggregations":{"category_counts":{"buckets":[]}}}

D {"error":"Field [category.keyword] not found"}

💡 Hint

Terms aggregation groups documents by unique values of the specified field and counts them.

The terms aggregation groups documents by the unique values in the 'category.keyword' field and returns the top 3 terms with their document counts. Option A shows the correct counts and keys.

❓ Predict Output

intermediate

Histogram aggregation bucket counts

Given this histogram aggregation query on a field price, what is the number of buckets returned?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "price_ranges": {
      "histogram": {
        "field": "price",
        "interval": 50
      }
    }
  }
}

A 0

B 10

C 5

D Error: interval must be positive

💡 Hint

Histogram buckets are created by dividing the range of values by the interval.

The histogram aggregation creates buckets of size 50 for the price field. Given the data range, it results in 5 buckets.

🧠 Conceptual

advanced

Understanding bucket aggregation behavior

Which statement correctly describes how the terms aggregation orders buckets by default?

A Buckets are ordered by the term value in ascending order.

B Buckets are ordered by document count in ascending order.

C Buckets are ordered randomly each query execution.

D Buckets are ordered by document count in descending order.

💡 Hint

Think about which buckets Elasticsearch shows first by default.

By default, terms aggregation orders buckets by their document count in descending order, showing the most frequent terms first.

❓ Predict Output

advanced

Error from invalid histogram interval

What error does this histogram aggregation query produce?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "price_histogram": {
      "histogram": {
        "field": "price",
        "interval": 0
      }
    }
  }
}

A Error: interval must be greater than 0

B Error: interval must be an integer

C Error: field [price] not found

D No error, returns empty buckets

💡 Hint

Histogram interval cannot be zero or negative.

The histogram aggregation requires a positive interval. Zero interval causes an error indicating the interval must be greater than 0.

🚀 Application

expert

Combining terms and histogram aggregations

You want to find the count of documents grouped first by category.keyword and then by price ranges of 100. Which aggregation structure achieves this?

A

{
  "size": 0,
  "aggs": {
    "categories": {
      "histogram": { "field": "category.keyword", "interval": 100 },
      "aggs": {
        "price_ranges": {
          "terms": { "field": "price" }
        }
      }
    }
  }
}

B

{
  "size": 0,
  "aggs": {
    "categories": {
      "terms": { "field": "category.keyword" },
      "aggs": {
        "price_ranges": {
          "histogram": { "field": "price", "interval": 100 }
        }
      }
    }
  }
}

C

{
  "size": 0,
  "aggs": {
    "price_ranges": {
      "histogram": { "field": "price", "interval": 100 },
      "aggs": {
        "categories": {
          "terms": { "field": "category.keyword" }
        }
      }
    }
  }
}

D

{
  "size": 0,
  "aggs": {
    "categories": {
      "terms": { "field": "category" },
      "aggs": {
        "price_ranges": {
          "histogram": { "field": "price.keyword", "interval": 100 }
        }
      }
    }
  }
}

💡 Hint

The first aggregation groups by category, then inside each category bucket, the histogram groups by price ranges.

Option B correctly nests a terms aggregation on 'category.keyword' with a sub-aggregation histogram on 'price' with interval 100. Other options misuse field types or order.

Practice

1.

What does the terms aggregation do in Elasticsearch?

easy

A. Sorts documents by date in ascending order

B. Groups documents by unique values of a field and counts them

C. Filters documents based on a numeric range

D. Calculates the average value of a numeric field

Solution

1. Step 1: Understand the purpose of terms aggregation

   The terms aggregation groups documents by unique values of a specified field.

2. Step 2: Recognize the output of terms aggregation

   It counts how many documents fall into each unique value group.

3. Final Answer:

   Groups documents by unique values of a field and counts them -> Option B

4. Quick Check:

   terms aggregation = grouping by unique values [OK]

Hint: Remember: terms = group by unique values and count [OK]

Common Mistakes:

• Confusing terms with filtering
• Thinking terms sorts documents
• Mixing terms with metric aggregations

2.

Which of the following is the correct syntax for a histogram aggregation on a field named price with interval 50?

{
  "aggs": {
    "price_ranges": {
      "histogram": {
        "field": "price",
        "interval": 50
      }
    }
  }
}

easy

A. Correct as shown

B. Use "interval": "50" (string instead of number)

C. Use "terms" instead of "histogram"

D. Place "interval" outside "histogram" block

Solution

1. Step 1: Check the structure of histogram aggregation

   The histogram aggregation requires a field and a numeric interval inside its block.

2. Step 2: Verify the given JSON syntax

   The example correctly places field and interval inside the histogram object with interval as a number.

3. Final Answer:

   Correct as shown -> Option A

4. Quick Check:

   Histogram syntax with numeric interval = correct [OK]

Hint: Interval must be a number inside histogram block [OK]

Common Mistakes:

• Using string instead of number for interval
• Confusing terms and histogram aggregations
• Placing interval outside histogram object

3.

Given this aggregation query:

{
  "aggs": {
    "by_category": {
      "terms": { "field": "category.keyword" }
    }
  }
}

What will the aggregation return?

medium

A. The average value of the category field

B. A histogram of categories grouped by numeric ranges

C. A list of unique categories with document counts for each

D. A filtered list of documents matching category.keyword

Solution

1. Step 1: Identify the aggregation type and field

   The query uses a terms aggregation on the category.keyword field, which groups by unique values.

2. Step 2: Understand the output of terms aggregation

   It returns buckets for each unique category with counts of documents in each bucket.

3. Final Answer:

   A list of unique categories with document counts for each -> Option C

4. Quick Check:

   Terms aggregation output = unique value buckets with counts [OK]

Hint: Terms aggregation returns unique values with counts [OK]

Common Mistakes:

• Thinking histogram groups string fields
• Expecting average instead of counts
• Confusing filtering with aggregation

4.

Identify the error in this aggregation query:

{
  "aggs": {
    "price_buckets": {
      "histogram": {
        "field": "price",
        "interval": "100"
      }
    }
  }
}

medium

A. The field name "price" is invalid

B. Missing "size" parameter for histogram

C. Histogram aggregation cannot be nested inside aggs

D. The interval value should be a number, not a string

Solution

1. Step 1: Check the type of the interval parameter

   The interval must be a numeric value, but here it is given as a string "100".

2. Step 2: Understand impact of wrong interval type

   Using a string instead of a number causes a syntax error or unexpected behavior in Elasticsearch.

3. Final Answer:

   The interval value should be a number, not a string -> Option D

4. Quick Check:

   Interval must be numeric, not string [OK]

Hint: Interval must be numeric, not quoted string [OK]

Common Mistakes:

• Using string instead of number for interval
• Assuming field name is wrong without checking
• Thinking histogram can't be inside aggs

5.

You want to group sales data by price ranges of 100 units and then within each price range, group by product category. Which aggregation structure should you use?

hard

A. { "aggs": { "price_ranges": { "histogram": { "field": "price", "interval": 100 }, "aggs": { "by_category": { "terms": { "field": "category.keyword" } } } } } }

B. { "aggs": { "by_category": { "terms": { "field": "category.keyword" }, "aggs": { "price_ranges": { "histogram": { "field": "price", "interval": 100 } } } } } }

C. { "aggs": { "price_ranges": { "terms": { "field": "price" }, "aggs": { "by_category": { "histogram": { "field": "category.keyword", "interval": 100 } } } } } }

D. { "aggs": { "by_category": { "histogram": { "field": "category.keyword", "interval": 100 }, "aggs": { "price_ranges": { "terms": { "field": "price" } } } } } }

Solution

1. Step 1: Identify the primary grouping by price ranges

   The outer aggregation should be a histogram on the price field with interval 100 to group sales by price ranges.

2. Step 2: Nest the category grouping inside each price range bucket

   Inside each price range bucket, use a terms aggregation on category.keyword to group by product category.

3. Final Answer:

   Aggregation with histogram on price and nested terms on category -> Option A

4. Quick Check:

   Histogram outer, terms nested = correct structure [OK]

Hint: Nest terms inside histogram for grouped sub-buckets [OK]

Common Mistakes:

• Reversing the order of aggregations
• Using terms for numeric price instead of histogram
• Using histogram on keyword fields