Nested aggregations in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of nested terms aggregation

What is the output of the following Elasticsearch aggregation query on an index with documents containing category and brand fields?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "by_category": {
      "terms": { "field": "category.keyword" },
      "aggs": {
        "by_brand": {
          "terms": { "field": "brand.keyword" }
        }
      }
    }
  }
}

A A flat list of all brands with their doc counts, ignoring categories

B A buckets list grouped by category, each containing buckets grouped by brand with their doc counts

C An error because nested aggregations require a nested field type

D A single bucket with the total doc count of the index

💡 Hint

Think about how terms aggregations group documents hierarchically.

The query groups documents first by category, then within each category by brand, producing nested buckets with counts.

❓ Predict Output

intermediate

Result of nested aggregation with metric

Given this aggregation query, what is the value of max_price inside each by_category bucket?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "by_category": {
      "terms": { "field": "category.keyword" },
      "aggs": {
        "max_price": { "max": { "field": "price" } }
      }
    }
  }
}

A The highest price value among documents in each category bucket

B An error because max aggregation cannot be nested inside terms

C The average price value in each category bucket

D The highest price value across the entire index, repeated for each category

💡 Hint

Max aggregation calculates the maximum value within its bucket.

The max aggregation inside each category bucket calculates the highest price among documents in that category.

🔧 Debug

advanced

Identify the error in nested aggregation query

What error will this Elasticsearch query produce?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "nested_agg": {
      "nested": { "path": "comments" },
      "aggs": {
        "by_user": {
          "terms": { "field": "user.keyword" }
        }
      }
    }
  }
}

A SyntaxError due to missing closing brace

B No error; query runs successfully and returns nested buckets

C Field [user.keyword] not found because it is outside the nested path

D Aggregation type [nested] is not supported

💡 Hint

Nested aggregations require fields inside the nested path.

The terms aggregation uses a field outside the nested path, causing a field not found error.

🧠 Conceptual

advanced

Purpose of nested aggregation in Elasticsearch

Why do we use nested aggregations in Elasticsearch?

A To flatten nested documents into a single level

B To speed up queries by avoiding filters

C To perform aggregations only on root-level fields

D To aggregate data inside nested objects or arrays within documents

💡 Hint

Think about how nested fields are stored and queried.

Nested aggregations allow grouping and metrics on fields inside nested objects, which are stored separately in Elasticsearch.

❓ Predict Output

expert

Output of deeply nested aggregation with filters

What is the output doc count of the innermost bucket in this nested aggregation?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "nested_comments": {
      "nested": { "path": "comments" },
      "aggs": {
        "filtered_comments": {
          "filter": { "term": { "comments.approved": true } },
          "aggs": {
            "by_user": {
              "terms": { "field": "comments.user.keyword" },
              "aggs": {
                "max_likes": { "max": { "field": "comments.likes" } }
              }
            }
          }
        }
      }
    }
  }
}

A The count of approved comments grouped by user with their max likes

B The total count of all comments ignoring approval status

C An error because filter aggregation cannot be nested inside nested aggregation

D The count of all users in the index regardless of comments

💡 Hint

Filter aggregation narrows down nested documents before terms aggregation.

The nested aggregation accesses comments, filter selects approved ones, then groups by user with max likes metric.