Metric aggregations (avg, sum, min, max) in Elasticsearch - Step-by-Step Execution

Concept Flow - Metric aggregations (avg, sum, min, max)

Start Query

↓

Select Metric Aggregation

↓

Elasticsearch Processes Data

↓

Calculate Metric (avg, sum, min, max)

↓

Return Aggregation Result

↓

Display Result

The flow shows how a metric aggregation query is sent to Elasticsearch, which processes the data and returns the calculated metric result.

Execution Sample

Elasticsearch

{
  "aggs": {
    "average_price": { "avg": { "field": "price" } }
  }
}

This query calculates the average value of the 'price' field in the documents.

Execution Table

Step	Action	Field	Aggregation Type	Intermediate Result	Final Result
1	Start query	-	-	-	-
2	Select aggregation	price	avg	-	-
3	Elasticsearch scans documents	price	avg	Collect values: [10, 20, 30, 40]	-
4	Calculate aggregation	price	avg	-	Average = (10+20+30+40)/4 = 25
5	Return result	price	avg	-	25

💡 All documents processed, average calculated and returned.

Variable Tracker

Variable	Start	After Step 3	After Step 4	Final
values_collected	[]	[10, 20, 30, 40]	[10, 20, 30, 40]	[10, 20, 30, 40]
aggregation_result	null	null	25	25

Key Moments - 3 Insights

Why does Elasticsearch collect all values before calculating the average?

Because the average needs all values to sum and count them, as shown in execution_table step 3 and 4.

What happens if the field has missing values in some documents?

Elasticsearch ignores missing values in the aggregation calculation, so only existing values are used, as implied in step 3.

Can we use the same flow for sum, min, and max aggregations?

Yes, the flow is similar; only the calculation step changes to sum, min, or max instead of average.

Visual Quiz - 3 Questions

Look at the execution_table, what is the intermediate collected values at step 3?

A [25]

B [10, 20, 30, 40]

C []

D [5, 15, 25]

💡 Hint

Check the 'Intermediate Result' column at step 3 in the execution_table.

At which step is the final average calculated?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look for the step where 'Average = (10+20+30+40)/4 = 25' appears in the execution_table.

If the field had missing values, how would the 'values_collected' change after step 3?

A It would only include existing values, ignoring missing ones

B It would include nulls for missing values

C It would be empty

D It would double the values

💡 Hint

Refer to key_moments explanation about missing values and step 3 in execution_table.

Concept Snapshot

Metric aggregations in Elasticsearch calculate summary values like avg, sum, min, max.
Syntax: { "aggs": { "name": { "avg": { "field": "fieldname" } } } }
Elasticsearch collects field values, then computes the metric.
Missing values are ignored in calculations.
Same flow applies for sum, min, max with different calculation steps.

Full Transcript

This visual execution trace shows how Elasticsearch performs metric aggregations such as average, sum, min, and max. The process starts with a query selecting the aggregation type and field. Elasticsearch scans documents, collects the field values, and then calculates the metric. For example, the average is computed by summing all collected values and dividing by their count. Missing values in documents are ignored during aggregation. The final result is returned and displayed. This flow is similar for sum, min, and max aggregations, differing only in the calculation step.

Practice

1. What does the avg metric aggregation calculate in an Elasticsearch query?

easy

A. The average value of a numeric field across documents

B. The total count of documents matching the query

C. The maximum value of a numeric field

D. The minimum value of a numeric field

Solution

1. Step 1: Understand the purpose of avg aggregation

   The avg aggregation calculates the average (mean) of values in a numeric field.

2. Step 2: Compare with other metric aggregations

   Other aggregations like sum, min, and max calculate total, minimum, and maximum respectively, not average.

3. Final Answer:

   The average value of a numeric field across documents -> Option A

4. Quick Check:

   avg = average value [OK]

Hint: avg means average value, not count or min/max [OK]

Common Mistakes:

• Confusing avg with sum or count
• Thinking avg returns min or max values
• Mixing avg with document count

2. Which of the following is the correct syntax to calculate the sum of the field price in an Elasticsearch aggregation?

easy

A. "aggs": { "total_price": { "sum": { "field": "price" } } }

B. "aggs": { "total_price": { "avg": { "field": "price" } } }

C. "aggs": { "total_price": { "max": { "field": "price" } } }

D. "aggs": { "total_price": { "min": { "field": "price" } } }

Solution

1. Step 1: Identify the aggregation type for sum

   The aggregation type to calculate sum is sum.

2. Step 2: Check the syntax structure

   The correct syntax uses "sum": { "field": "price" } inside aggs.

3. Final Answer:

   "aggs": { "total_price": { "sum": { "field": "price" } } } -> Option A

4. Quick Check:

   sum aggregation syntax = "aggs": { "total_price": { "sum": { "field": "price" } } } [OK]

Hint: sum uses "sum": { "field": "fieldname" } syntax [OK]

Common Mistakes:

• Using avg or max instead of sum
• Missing the field name inside sum
• Wrong nesting of aggregation keys

3. Given this Elasticsearch aggregation query snippet, what will be the output for the max_price aggregation?

{
  "aggs": {
    "max_price": {
      "max": { "field": "price" }
    }
  }
}

Assuming the documents have prices: 10, 25, 7, 30, 15.

medium

A. 25

B. 30

C. 15

D. 10

Solution

1. Step 1: Understand max aggregation

   The max aggregation returns the highest value of the specified field.

2. Step 2: Identify the maximum price from the list

   From the prices 10, 25, 7, 30, 15, the maximum is 30.

3. Final Answer:

   30 -> Option B

4. Quick Check:

   max price = 30 [OK]

Hint: max returns the highest number in the field values [OK]

Common Mistakes:

• Choosing the second highest value instead of max
• Confusing max with avg or sum
• Ignoring the actual field values

4. Identify the error in this Elasticsearch aggregation query that tries to calculate the minimum value of the field age:

{
  "aggs": {
    "min_age": {
      "min": "age"
    }
  }
}

medium

A. The query is missing a "query" section

B. The aggregation name "min_age" is invalid

C. The aggregation type should be "max" instead of "min"

D. The field name should be inside a nested object with key "field"

Solution

1. Step 1: Check the syntax for min aggregation

   The min aggregation requires the field name inside an object with key "field".

2. Step 2: Identify the error in the given query

   The query uses "min": "age" instead of "min": { "field": "age" } which is incorrect syntax.

3. Final Answer:

   The field name should be inside a nested object with key "field" -> Option D

4. Quick Check:

   min aggregation needs "field": "age" [OK]

Hint: Field must be inside { "field": "name" } for metric aggs [OK]

Common Mistakes:

• Passing field name as string directly without object
• Confusing aggregation type names
• Assuming query section is mandatory for aggregation

5. You want to find the average, sum, minimum, and maximum values of the field score using the avg, sum, min, and max aggregations in a single Elasticsearch query. Which aggregation structure correctly achieves this?

hard

A. { "aggs": { "score_metrics": { "metric": [ { "avg": { "field": "score" } }, { "sum": { "field": "score" } } ] } } }

B. { "aggs": { "score_stats": { "stats": { "field": "score" } } } }

C. { "aggs": { "avg_score": { "avg": { "field": "score" } }, "sum_score": { "sum": { "field": "score" } }, "min_score": { "min": { "field": "score" } }, "max_score": { "max": { "field": "score" } } } }

D. { "aggs": { "score": { "avg": { "field": "score" }, "sum": { "field": "score" }, "min": { "field": "score" }, "max": { "field": "score" } } } }

Solution

1. Step 1: Understand how to combine multiple metric aggregations

   Each metric aggregation must be a separate named aggregation inside aggs.

2. Step 2: Analyze each option's structure

   { "aggs": { "avg_score": { "avg": { "field": "score" } }, "sum_score": { "sum": { "field": "score" } }, "min_score": { "min": { "field": "score" } }, "max_score": { "max": { "field": "score" } } } } correctly defines four separate aggregations for avg, sum, min, and max on the field score. { "aggs": { "score_stats": { "stats": { "field": "score" } } } } uses stats which returns all metrics but is not separate aggregations. { "aggs": { "score_metrics": { "metric": [ { "avg": { "field": "score" } }, { "sum": { "field": "score" } } ] } } } and D have invalid syntax or unsupported structures.

3. Final Answer:

   Separate named aggregations for avg, sum, min, and max inside aggs -> Option C

4. Quick Check:

   Multiple metric aggs need separate keys inside aggs [OK]

Hint: Use separate named aggs for each metric under aggs [OK]

Common Mistakes:

• Trying to combine metrics inside one aggregation object
• Using unsupported array or metric keys
• Confusing stats aggregation with separate metric aggs