Nested aggregations in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a nested aggregation in Elasticsearch?

A nested aggregation lets you group and analyze data inside nested objects within documents. It helps explore data inside arrays or objects stored as nested types.

beginner

How do you define a nested aggregation in an Elasticsearch query?

You use the "nested" aggregation type and specify the path to the nested field. Inside it, you can add sub-aggregations to analyze nested data.

intermediate

Why do we need nested aggregations instead of normal aggregations for nested fields?

Normal aggregations treat nested objects as flat fields, which can mix data from different nested objects. Nested aggregations keep nested objects separate for accurate results.

intermediate

Example: What does this nested aggregation do? { "nested": { "path": "comments" }, "aggs": { "top_authors": { "terms": { "field": "comments.author.keyword" } } } }

It looks inside the "comments" nested field and groups the comments by author, showing the most common comment authors.

beginner

What is the role of the "path" parameter in a nested aggregation?

The "path" tells Elasticsearch which nested field to look inside. It defines the nested object scope for the aggregation.

What does a nested aggregation in Elasticsearch analyze?

A Only numeric fields

B Only top-level document fields

C Data inside nested objects or arrays

D Data from external databases

Nested aggregations analyze data inside nested objects or arrays stored as nested types.

Which parameter specifies the nested field path in a nested aggregation?

A field

B nested_path

C type

D path

The "path" parameter defines the nested field path to analyze.

Why can't normal aggregations be used directly on nested fields?

A They mix data from different nested objects

B They are slower

C They only work on strings

D They require scripting

Normal aggregations flatten nested data, mixing different nested objects and causing inaccurate results.

In a nested aggregation, where do you place sub-aggregations?

A At the root level

B Inside the "aggs" object within the nested aggregation

C Inside the "nested" object

D Outside the query

Sub-aggregations go inside the "aggs" object nested within the nested aggregation.

What type of data structure must the nested field be in Elasticsearch for nested aggregations?

A Nested type

B Text

C Keyword

D Date

The field must be mapped as a nested type to use nested aggregations.

Explain how nested aggregations work in Elasticsearch and why they are important.

Think about how arrays of objects are stored and how to analyze them separately.

Describe a simple example of a nested aggregation query and what it returns.

Imagine you have comments inside documents and want to count authors.

Practice

1. What is the main purpose of nested aggregations in Elasticsearch?

easy

A. To sort documents by a single field

B. To group data inside other groups for multi-level analysis

C. To filter documents based on a condition

D. To update documents in bulk

Solution

1. Step 1: Recall aggregation basics

   Aggregations group data to summarize or analyze it.

2. Step 2: Examine nested aggregations

   Nested aggregations group data inside other groups for detailed multi-level insights.

3. Final Answer:

   To group data inside other groups for multi-level analysis -> Option B

4. Quick Check:

   Nested aggregations = multi-level grouping [OK]

Hint: Nested aggs always use 'aggs' inside another aggregation [OK]

Common Mistakes:

• Confusing nested aggregations with filters
• Thinking nested aggregations sort data
• Assuming nested aggregations update documents

2. Which of the following is the correct syntax to add a nested aggregation inside a terms aggregation in Elasticsearch?

easy

A. "aggs": { "country": { "terms": { "field": "country" }, "aggs": { "city": { "terms": { "field": "city" } } } } }

B. "nested": { "aggs": { "terms": { "field": "city" } } }

C. "aggs": { "nested_agg": { "terms": { "field": "city" } } }

D. "aggs": { "terms": { "field": "city" }, "aggs": { "nested_agg": { "terms": { "field": "country" } } } }

Solution

1. Step 1: Identify correct nested aggregation structure

   Nested aggregations are placed inside the "aggs" key of a parent aggregation.

2. Step 2: Check "aggs": { "country": { "terms": { "field": "country" }, "aggs": { "city": { "terms": { "field": "city" } } } } } structure

   "aggs": { "country": { "terms": { "field": "country" }, "aggs": { "city": { "terms": { "field": "city" } } } } } shows a terms aggregation on "country" with a nested terms aggregation on "city" inside its "aggs" key, which is correct syntax.

3. Final Answer:

   "aggs": { "country": { "terms": { "field": "country" }, "aggs": { "city": { "terms": { "field": "city" } } } } } -> Option A

4. Quick Check:

   Nested aggs inside parent's "aggs" key = "aggs": { "country": { "terms": { "field": "country" }, "aggs": { "city": { "terms": { "field": "city" } } } } } [OK]

Hint: Nested aggs go inside parent's "aggs" key, not outside [OK]

Common Mistakes:

• Placing multiple "aggs" keys at the same level
• Using "nested" keyword incorrectly
• Missing the "aggs" key inside parent aggregation

3. Given this Elasticsearch aggregation query snippet:

{
  "aggs": {
    "by_country": {
      "terms": { "field": "country" },
      "aggs": {
        "by_city": {
          "terms": { "field": "city" }
        }
      }
    }
  }
}

What does the nested aggregation by_city do?

medium

A. Groups documents by city inside each country group

B. Filters documents only from one city

C. Sorts countries by city name

D. Counts total documents ignoring country

Solution

1. Step 1: Analyze the outer aggregation

   "by_country" groups documents by the "country" field.

2. Step 2: Analyze the nested aggregation

   Inside each country group, "by_city" groups documents by the "city" field.

3. Final Answer:

   Groups documents by city inside each country group -> Option A

4. Quick Check:

   Nested terms aggregation groups inside parent group [OK]

Hint: Nested terms aggs group data inside parent buckets [OK]

Common Mistakes:

• Thinking nested aggs filter data
• Assuming nested aggs sort data
• Ignoring the parent aggregation grouping

4. Identify the error in this nested aggregation query:

{
  "aggs": {
    "countries": {
      "terms": { "field": "country" },
      "terms": {
        "field": "city"
      }
    }
  }
}

medium

A. Using "terms" twice at the same level is correct

B. Aggregation names cannot be plural

C. Field names "country" and "city" must be the same

D. Missing nested "aggs" key for the city aggregation

Solution

1. Step 1: Check aggregation structure

   Each aggregation can have only one aggregation type key like "terms" at its level.

2. Step 2: Identify nested aggregation placement

   Nested aggregations must be inside an "aggs" key, but here "terms" is repeated instead of nesting inside "aggs".

3. Final Answer:

   Missing nested "aggs" key for the city aggregation -> Option D

4. Quick Check:

   Nested aggs require "aggs" key inside parent [OK]

Hint: Nested aggs must be inside "aggs", not repeated aggregation keys [OK]

Common Mistakes:

• Repeating aggregation type keys at same level
• Not nesting inside "aggs" key
• Confusing aggregation names with field names

5. You want to analyze sales data by region, then by product category, and finally by brand using nested aggregations. Which of the following query structures correctly implements this three-level nested aggregation?

hard

A. { "aggs": { "region": { "terms": { "field": "region" }, "terms": { "field": "category" }, "terms": { "field": "brand" } } } }

B. { "aggs": { "region": { "terms": { "field": "region" } }, "category": { "terms": { "field": "category" } }, "brand": { "terms": { "field": "brand" } } } }

C. { "aggs": { "region": { "terms": { "field": "region" }, "aggs": { "category": { "terms": { "field": "category" }, "aggs": { "brand": { "terms": { "field": "brand" } } } } } } } }

D. { "aggs": { "brand": { "terms": { "field": "brand" }, "aggs": { "category": { "terms": { "field": "category" }, "aggs": { "region": { "terms": { "field": "region" } } } } } } } }

Solution

1. Step 1: Identify the required nesting order

   We want to group first by region, then inside each region by category, then inside each category by brand.

2. Step 2: Check each option's structure

   { "aggs": { "region": { "terms": { "field": "region" }, "aggs": { "category": { "terms": { "field": "category" }, "aggs": { "brand": { "terms": { "field": "brand" } } } } } } } correctly nests "category" inside "region"'s "aggs", and "brand" inside "category"'s "aggs". Others either flatten or reverse order.

3. Final Answer:

   { "aggs": { "region": { "terms": { "field": "region" }, "aggs": { "category": { "terms": { "field": "category" }, "aggs": { "brand": { "terms": { "field": "brand" } } } } } } } -> Option C

4. Quick Check:

   Nested aggs inside parent's "aggs" in correct order = { "aggs": { "region": { "terms": { "field": "region" }, "aggs": { "category": { "terms": { "field": "category" }, "aggs": { "brand": { "terms": { "field": "brand" } } } } } } } [OK]

Hint: Nest each level inside previous level's "aggs" key [OK]

Common Mistakes:

• Placing all aggregations at top level without nesting
• Repeating aggregation keys at same level
• Reversing the desired grouping order