Nested aggregations in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of nested terms aggregation

What is the output of the following Elasticsearch aggregation query on an index with documents containing category and brand fields?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "by_category": {
      "terms": { "field": "category.keyword" },
      "aggs": {
        "by_brand": {
          "terms": { "field": "brand.keyword" }
        }
      }
    }
  }
}

A A flat list of all brands with their doc counts, ignoring categories

B A buckets list grouped by category, each containing buckets grouped by brand with their doc counts

C An error because nested aggregations require a nested field type

D A single bucket with the total doc count of the index

💡 Hint

Think about how terms aggregations group documents hierarchically.

The query groups documents first by category, then within each category by brand, producing nested buckets with counts.

❓ Predict Output

intermediate

Result of nested aggregation with metric

Given this aggregation query, what is the value of max_price inside each by_category bucket?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "by_category": {
      "terms": { "field": "category.keyword" },
      "aggs": {
        "max_price": { "max": { "field": "price" } }
      }
    }
  }
}

A The highest price value among documents in each category bucket

B An error because max aggregation cannot be nested inside terms

C The average price value in each category bucket

D The highest price value across the entire index, repeated for each category

💡 Hint

Max aggregation calculates the maximum value within its bucket.

The max aggregation inside each category bucket calculates the highest price among documents in that category.

🔧 Debug

advanced

Identify the error in nested aggregation query

What error will this Elasticsearch query produce?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "nested_agg": {
      "nested": { "path": "comments" },
      "aggs": {
        "by_user": {
          "terms": { "field": "user.keyword" }
        }
      }
    }
  }
}

A SyntaxError due to missing closing brace

B No error; query runs successfully and returns nested buckets

C Field [user.keyword] not found because it is outside the nested path

D Aggregation type [nested] is not supported

💡 Hint

Nested aggregations require fields inside the nested path.

The terms aggregation uses a field outside the nested path, causing a field not found error.

🧠 Conceptual

advanced

Purpose of nested aggregation in Elasticsearch

Why do we use nested aggregations in Elasticsearch?

A To flatten nested documents into a single level

B To speed up queries by avoiding filters

C To perform aggregations only on root-level fields

D To aggregate data inside nested objects or arrays within documents

💡 Hint

Think about how nested fields are stored and queried.

Nested aggregations allow grouping and metrics on fields inside nested objects, which are stored separately in Elasticsearch.

❓ Predict Output

expert

Output of deeply nested aggregation with filters

What is the output doc count of the innermost bucket in this nested aggregation?

Elasticsearch

{
  "size": 0,
  "aggs": {
    "nested_comments": {
      "nested": { "path": "comments" },
      "aggs": {
        "filtered_comments": {
          "filter": { "term": { "comments.approved": true } },
          "aggs": {
            "by_user": {
              "terms": { "field": "comments.user.keyword" },
              "aggs": {
                "max_likes": { "max": { "field": "comments.likes" } }
              }
            }
          }
        }
      }
    }
  }
}

A The count of approved comments grouped by user with their max likes

B The total count of all comments ignoring approval status

C An error because filter aggregation cannot be nested inside nested aggregation

D The count of all users in the index regardless of comments

💡 Hint

Filter aggregation narrows down nested documents before terms aggregation.

The nested aggregation accesses comments, filter selects approved ones, then groups by user with max likes metric.

Practice

1. What is the main purpose of nested aggregations in Elasticsearch?

easy

A. To sort documents by a single field

B. To group data inside other groups for multi-level analysis

C. To filter documents based on a condition

D. To update documents in bulk

Solution

1. Step 1: Recall aggregation basics

   Aggregations group data to summarize or analyze it.

2. Step 2: Examine nested aggregations

   Nested aggregations group data inside other groups for detailed multi-level insights.

3. Final Answer:

   To group data inside other groups for multi-level analysis -> Option B

4. Quick Check:

   Nested aggregations = multi-level grouping [OK]

Hint: Nested aggs always use 'aggs' inside another aggregation [OK]

Common Mistakes:

• Confusing nested aggregations with filters
• Thinking nested aggregations sort data
• Assuming nested aggregations update documents

2. Which of the following is the correct syntax to add a nested aggregation inside a terms aggregation in Elasticsearch?

easy

A. "aggs": { "country": { "terms": { "field": "country" }, "aggs": { "city": { "terms": { "field": "city" } } } } }

B. "nested": { "aggs": { "terms": { "field": "city" } } }

C. "aggs": { "nested_agg": { "terms": { "field": "city" } } }

D. "aggs": { "terms": { "field": "city" }, "aggs": { "nested_agg": { "terms": { "field": "country" } } } }

Solution

1. Step 1: Identify correct nested aggregation structure

   Nested aggregations are placed inside the "aggs" key of a parent aggregation.

2. Step 2: Check "aggs": { "country": { "terms": { "field": "country" }, "aggs": { "city": { "terms": { "field": "city" } } } } } structure

   "aggs": { "country": { "terms": { "field": "country" }, "aggs": { "city": { "terms": { "field": "city" } } } } } shows a terms aggregation on "country" with a nested terms aggregation on "city" inside its "aggs" key, which is correct syntax.

3. Final Answer:

   "aggs": { "country": { "terms": { "field": "country" }, "aggs": { "city": { "terms": { "field": "city" } } } } } -> Option A

4. Quick Check:

   Nested aggs inside parent's "aggs" key = "aggs": { "country": { "terms": { "field": "country" }, "aggs": { "city": { "terms": { "field": "city" } } } } } [OK]

Hint: Nested aggs go inside parent's "aggs" key, not outside [OK]

Common Mistakes:

• Placing multiple "aggs" keys at the same level
• Using "nested" keyword incorrectly
• Missing the "aggs" key inside parent aggregation

3. Given this Elasticsearch aggregation query snippet:

{
  "aggs": {
    "by_country": {
      "terms": { "field": "country" },
      "aggs": {
        "by_city": {
          "terms": { "field": "city" }
        }
      }
    }
  }
}

What does the nested aggregation by_city do?

medium

A. Groups documents by city inside each country group

B. Filters documents only from one city

C. Sorts countries by city name

D. Counts total documents ignoring country

Solution

1. Step 1: Analyze the outer aggregation

   "by_country" groups documents by the "country" field.

2. Step 2: Analyze the nested aggregation

   Inside each country group, "by_city" groups documents by the "city" field.

3. Final Answer:

   Groups documents by city inside each country group -> Option A

4. Quick Check:

   Nested terms aggregation groups inside parent group [OK]

Hint: Nested terms aggs group data inside parent buckets [OK]

Common Mistakes:

• Thinking nested aggs filter data
• Assuming nested aggs sort data
• Ignoring the parent aggregation grouping

4. Identify the error in this nested aggregation query:

{
  "aggs": {
    "countries": {
      "terms": { "field": "country" },
      "terms": {
        "field": "city"
      }
    }
  }
}

medium

A. Using "terms" twice at the same level is correct

B. Aggregation names cannot be plural

C. Field names "country" and "city" must be the same

D. Missing nested "aggs" key for the city aggregation

Solution

1. Step 1: Check aggregation structure

   Each aggregation can have only one aggregation type key like "terms" at its level.

2. Step 2: Identify nested aggregation placement

   Nested aggregations must be inside an "aggs" key, but here "terms" is repeated instead of nesting inside "aggs".

3. Final Answer:

   Missing nested "aggs" key for the city aggregation -> Option D

4. Quick Check:

   Nested aggs require "aggs" key inside parent [OK]

Hint: Nested aggs must be inside "aggs", not repeated aggregation keys [OK]

Common Mistakes:

• Repeating aggregation type keys at same level
• Not nesting inside "aggs" key
• Confusing aggregation names with field names

5. You want to analyze sales data by region, then by product category, and finally by brand using nested aggregations. Which of the following query structures correctly implements this three-level nested aggregation?

hard

A. { "aggs": { "region": { "terms": { "field": "region" }, "terms": { "field": "category" }, "terms": { "field": "brand" } } } }

B. { "aggs": { "region": { "terms": { "field": "region" } }, "category": { "terms": { "field": "category" } }, "brand": { "terms": { "field": "brand" } } } }

C. { "aggs": { "region": { "terms": { "field": "region" }, "aggs": { "category": { "terms": { "field": "category" }, "aggs": { "brand": { "terms": { "field": "brand" } } } } } } } }

D. { "aggs": { "brand": { "terms": { "field": "brand" }, "aggs": { "category": { "terms": { "field": "category" }, "aggs": { "region": { "terms": { "field": "region" } } } } } } } }

Solution

1. Step 1: Identify the required nesting order

   We want to group first by region, then inside each region by category, then inside each category by brand.

2. Step 2: Check each option's structure

   { "aggs": { "region": { "terms": { "field": "region" }, "aggs": { "category": { "terms": { "field": "category" }, "aggs": { "brand": { "terms": { "field": "brand" } } } } } } } correctly nests "category" inside "region"'s "aggs", and "brand" inside "category"'s "aggs". Others either flatten or reverse order.

3. Final Answer:

   { "aggs": { "region": { "terms": { "field": "region" }, "aggs": { "category": { "terms": { "field": "category" }, "aggs": { "brand": { "terms": { "field": "brand" } } } } } } } -> Option C

4. Quick Check:

   Nested aggs inside parent's "aggs" in correct order = { "aggs": { "region": { "terms": { "field": "region" }, "aggs": { "category": { "terms": { "field": "category" }, "aggs": { "brand": { "terms": { "field": "brand" } } } } } } } [OK]

Hint: Nest each level inside previous level's "aggs" key [OK]

Common Mistakes:

• Placing all aggregations at top level without nesting
• Repeating aggregation keys at same level
• Reversing the desired grouping order