Range buckets in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of a simple range bucket aggregation

What is the output of this Elasticsearch aggregation query on the field price with the given buckets?

Elasticsearch

{
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 50 },
          { "from": 50, "to": 100 },
          { "from": 100 }
        ]
      }
    }
  }
}

A {"aggregations":{"price_ranges":{"buckets":[{"key":"*-50.0","to":50.0,"doc_count":5},{"key":"50.0-100.0","from":50.0,"to":100.0,"doc_count":3},{"key":"100.0-*","from":100.0,"doc_count":2}]}}}

B {"aggregations":{"price_ranges":{"buckets":[{"key":"*-50.0","to":50.0,"doc_count":3},{"key":"50.0-100.0","from":50.0,"to":100.0,"doc_count":5},{"key":"100.0-*","from":100.0,"doc_count":2}]}}}

C {"aggregations":{"price_ranges":{"buckets":[{"key":"*-50.0","to":50.0,"doc_count":2},{"key":"50.0-100.0","from":50.0,"to":100.0,"doc_count":3},{"key":"100.0-*","from":100.0,"doc_count":5}]}}}

D {"aggregations":{"price_ranges":{"buckets":[{"key":"*-50.0","to":50.0,"doc_count":4},{"key":"50.0-100.0","from":50.0,"to":100.0,"doc_count":4},{"key":"100.0-*","from":100.0,"doc_count":2}]}}}

💡 Hint

Look carefully at how documents are counted in each price range bucket.

The aggregation divides documents into three buckets: prices less than 50, prices between 50 and 100, and prices 100 or more. The doc_count reflects how many documents fall into each range.

🧠 Conceptual

intermediate

Understanding range bucket keys

In Elasticsearch range bucket aggregations, what does the bucket key "* - 100.0" represent?

A All documents with values less than 100

B All documents with values between 0 and 100

C All documents with values exactly equal to 100

D All documents with values greater than 100

💡 Hint

The asterisk (*) means unbounded on one side.

The key "* - 100.0" means the bucket includes all values less than 100, with no lower bound.

🔧 Debug

advanced

Identify the error in this range bucket aggregation

This aggregation query is intended to create two buckets: prices less than 20 and prices between 20 and 50. What error will Elasticsearch return?

Elasticsearch

{
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 20 },
          { "from": 20, "to": 50 },
          { "from": 50, "to": 10 }
        ]
      }
    }
  }
}

A Elasticsearch returns a syntax error due to missing commas

B Elasticsearch returns a validation error because the last range has from > to

C Elasticsearch returns no error and processes all buckets correctly

D Elasticsearch returns an error because the field "price" does not exist

💡 Hint

Check the order of from and to values in each range.

The last range has "from": 50 and "to": 10, which is invalid because from must be less than to.

📝 Syntax

advanced

Which option correctly defines a range bucket aggregation with open-ended ranges?

Select the correct JSON snippet for an Elasticsearch range aggregation with these buckets: less than 30, 30 to 70, and greater than 70.

A { "range": { "field": "age", "ranges": [ { "to": 30 }, { "from": 30, "to": 70 }, { "to": 70, "from": 70 } ] } }

B { "range": { "field": "age", "ranges": [ { "from": 0, "to": 30 }, { "from": 30, "to": 70 }, { "to": 70 } ] } }

C { "range": { "field": "age", "ranges": [ { "to": 30 }, { "from": 30, "to": 70 }, { "from": 70 } ] } }

D { "range": { "field": "age", "ranges": [ { "to": 30 }, { "from": 30, "to": 70 }, { "from": 70, "to": 100 } ] } }

💡 Hint

Open-ended ranges omit either from or to.

Option C correctly uses open-ended ranges: first bucket has only "to", last bucket has only "from".

🚀 Application

expert

Calculate total documents in overlapping range buckets

Given this range aggregation with overlapping buckets, what is the total number of documents counted across all buckets if the index has 10 documents with these price values: [10, 25, 40, 55, 60, 75, 80, 90, 110, 130]? Aggregation: { "aggs": { "price_ranges": { "range": { "field": "price", "ranges": [ { "to": 50 }, { "from": 30, "to": 70 }, { "from": 60 } ] } } } }

A 15

B 10

C 13

D 12

💡 Hint

Count how many documents fall into each bucket, then sum all counts.

The buckets overlap, so some documents are counted multiple times. Counting: - to 50: 10, 25, 40 → 3 docs - 30 to 70: 40, 55, 60 → 3 docs - from 60: 60, 75, 80, 90, 110, 130 → 6 docs Total = 3 + 3 + 6 = 12. But 60 is counted twice, so total is 3 + 3 + 6 = 12. Wait, 60 is counted in both 30-70 and from 60 buckets. Actually, 30 to 70 includes 40, 55, 60 (3 docs) from 60 includes 60, 75, 80, 90, 110, 130 (6 docs) to 50 includes 10, 25, 40 (3 docs) Sum = 3 + 3 + 6 = 12 But 40 and 60 are counted twice. The question asks total number of documents counted across all buckets (sum of doc_counts), so duplicates count. So total is 3 + 3 + 6 = 12. Option D is 13, so re-check. Counting carefully: - to 50: 10, 25, 40 → 3 - 30 to 70: 40, 55, 60 → 3 - from 60: 60, 75, 80, 90, 110, 130 → 6 Sum = 3 + 3 + 6 = 12 So correct answer is 12 (option D). Correction: The correct answer is C.