Nested aggregations in Elasticsearch - Step-by-Step Execution

Concept Flow - Nested aggregations

Start Query

↓

Outer Aggregation

↓

Inner Aggregation

↓

Collect Results

↓

Return Nested Aggregation Data

The query starts with an outer aggregation, then runs inner aggregations inside it, collects results, and returns nested aggregation data.

Execution Sample

Elasticsearch

{
  "aggs": {
    "by_category": {
      "terms": { "field": "category" },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    }
  }
}

This query groups documents by category and calculates the average price within each category.

Execution Table

Step	Aggregation Level	Aggregation Type	Field	Action	Result
1	Outer	terms	category	Group documents by category field	Buckets created for each category
2	Inner	avg	price	Calculate average price in each category bucket	Average price computed per bucket
3	Collect	N/A	N/A	Collect all buckets with their average price	Nested aggregation result ready
4	Return	N/A	N/A	Return nested aggregation data to client	Final JSON aggregation response

💡 All buckets processed and nested aggregations computed, query execution complete

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
buckets	empty	buckets by category created	avg price added to each bucket	all buckets collected	nested aggregation result

Key Moments - 2 Insights

Why do we need nested aggregations instead of just one aggregation?

Nested aggregations let us group data first (outer aggregation) and then calculate metrics inside each group (inner aggregation), as shown in execution_table rows 1 and 2.

What happens if the inner aggregation is missing?

If inner aggregation is missing, only the outer aggregation groups data but no metrics like average are calculated inside groups, so step 2 in execution_table would be skipped.

Visual Quiz - 3 Questions

Look at the execution_table, what aggregation type is used at the outer level?

A avg

B terms

C sum

D max

💡 Hint

Check execution_table row 1 under Aggregation Type column

At which step is the average price calculated inside each category?

A Step 2

B Step 1

C Step 3

D Step 4

💡 Hint

Look at execution_table row 2 Action and Result columns

If we remove the inner aggregation, what will be missing in the results?

A Buckets grouped by category

B Final JSON response

C Average price per category

D Query execution

💡 Hint

Refer to key_moments explanation about missing inner aggregation and execution_table row 2

Concept Snapshot

Nested aggregations group data first, then calculate metrics inside groups.
Syntax: outer aggregation with 'aggs' containing inner aggregations.
Outer example: 'terms' aggregation.
Inner example: 'avg' aggregation.
Results return nested buckets with metrics.
Use to analyze grouped data with detailed stats.

Full Transcript

Nested aggregations in Elasticsearch start by grouping documents using an outer aggregation, such as 'terms' on a field like category. Then, inside each group, inner aggregations compute metrics like average price. The process collects all buckets with their computed metrics and returns a nested JSON response. This allows detailed analysis by grouping data first and then calculating statistics inside each group. The execution table shows steps from grouping to metric calculation to result collection and return. Variables like buckets change from empty to filled with grouped data and metrics. Key moments clarify why nested aggregations are needed and what happens if inner aggregations are missing. The visual quiz tests understanding of aggregation types, steps, and effects of removing inner aggregations.