Range buckets in Elasticsearch - Mini Project: Build & Apply

Range Buckets

📖 Scenario: You work for an online store that wants to analyze sales data. You have a list of product prices and want to group them into price ranges to see how many products fall into each range.

🎯 Goal: Create an Elasticsearch query that uses range buckets to group products by price ranges: 0-50, 50-100, and 100-200.

📋 What You'll Learn

Create an Elasticsearch aggregation using range buckets on the price field.

Define three ranges: 0 to 50, 50 to 100, and 100 to 200.

Include a match_all query to select all products.

Print the final JSON query.

💡 Why This Matters

🌍 Real World

Range buckets help businesses understand how their products or sales are distributed across different value ranges, like price or age groups.

💼 Career

Knowing how to use range buckets in Elasticsearch is useful for data analysts and backend developers working with search and analytics platforms.

1

Create the base query

Create a JSON object called query with a match_all query to select all documents.

Elasticsearch

# Create the base query with match_all
# Your code here

Hint

The match_all query selects all documents in the index.

2

Add the range aggregation configuration

Add an aggs key to query with a price_ranges aggregation of type range on the price field. Define the ranges: 0 to 50, 50 to 100, and 100 to 200.

Elasticsearch

query = {
  "query": {
    "match_all": {}
  }
}
# Add aggs with price_ranges range aggregation
# Your code here

Hint

Use the range aggregation type and specify the field and ranges array.

3

Add the core logic to build the range buckets

Ensure the price_ranges aggregation correctly groups documents into the three price ranges using the range buckets on the price field.

Elasticsearch

query = {
  "query": {
    "match_all": {}
  },
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          {"to": 50},
          {"from": 50, "to": 100},
          {"from": 100, "to": 200}
        ]
      }
    }
  }
}
# Confirm the range buckets are set correctly
# Your code here

Hint

Check that the range aggregation has the correct field and ranges.

4

Print the final query

Print the query JSON object to display the complete Elasticsearch query with range buckets.

Elasticsearch

query = {
  "query": {
    "match_all": {}
  },
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          {"to": 50},
          {"from": 50, "to": 100},
          {"from": 100, "to": 200}
        ]
      }
    }
  }
}
# Print the query
# Your code here

Hint

Use print(json.dumps(query, indent=2)) to display the JSON nicely.

Practice

1.

What is the main purpose of range buckets in Elasticsearch aggregations?

easy

A. To update documents in the index

B. To sort documents alphabetically

C. To filter documents by exact match

D. To group documents into specified numeric or date ranges

Solution

1. Step 1: Understand range buckets concept

   Range buckets group documents based on numeric or date values falling within specified ranges.

2. Step 2: Compare options

   Only To group documents into specified numeric or date ranges describes grouping by ranges. Others describe unrelated operations.

3. Final Answer:

   To group documents into specified numeric or date ranges -> Option D

4. Quick Check:

   Range buckets = grouping by ranges [OK]

Hint: Range buckets group data by intervals, not sorting or filtering [OK]

Common Mistakes:

• Confusing range buckets with sorting
• Thinking range buckets filter exact matches
• Assuming range buckets update documents

2.

Which of the following is the correct syntax snippet to define a range bucket in Elasticsearch?

{ "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 }, { "from": 50, "to": 100 } ] }}

easy

A. { "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 } ] }}

B. { "range": { "field": "price", "buckets": [ { "from": 0, "to": 50 } ] }}

C. { "range": { "field": "price", "ranges": [ { "start": 0, "end": 50 } ] }}

D. { "range": { "field": "price", "intervals": [ { "from": 0, "to": 50 } ] }}

Solution

1. Step 1: Check correct keys for range buckets

   Elasticsearch uses "ranges" array with objects having "from" and "to" keys.

2. Step 2: Compare options

   Only { "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 } ] }} uses "ranges" with "from" and "to" correctly. Others use incorrect keys like "start", "buckets", or "intervals".

3. Final Answer:

   { "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 } ] }} -> Option A

4. Quick Check:

   Use "ranges" with "from" and "to" keys [OK]

Hint: Use "ranges" array with "from" and "to" keys for range buckets [OK]

Common Mistakes:

• Using "start" and "end" instead of "from" and "to"
• Using wrong key names like "buckets" or "intervals"
• Placing ranges outside the "range" object

3.

Given this aggregation query snippet, what will be the count of documents in the bucket with from: 10 and to: 20?

{
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 10 },
          { "from": 10, "to": 20 },
          { "from": 20 }
        ]
      }
    }
  }
}

Assume documents have prices: [5, 7, 10, 15, 18, 20, 25]

medium

A. 3

B. 2

C. 4

D. 1

Solution

1. Step 1: Identify which prices fall into the 10 to 20 range

   Prices are [5,7,10,15,18,20,25]. The bucket is from 10 (inclusive) to 20 (exclusive). So prices 10, 15, 18 count. Price 20 is excluded.

2. Step 2: Count matching documents

   Matching prices: 10, 15, 18 -> 3 documents.

3. Final Answer:

   3 -> Option A

4. Quick Check:

   Prices ≥10 and <20 count = 3 [OK]

Hint: Ranges include from (inclusive), exclude to (exclusive) by default [OK]

Common Mistakes:

• Counting price 20 in the 10-20 bucket
• Confusing inclusive/exclusive range ends
• Counting prices below 10 in this bucket

4.

Identify the error in this range bucket aggregation query:

{
  "aggs": {
    "age_ranges": {
      "range": {
        "field": "age",
        "ranges": [
          { "from": 0, "to": 19 },
          { "from": 18, "to": 30 },
          { "from": 30, "to": 50 }
        ]
      }
    }
  }
}

Why might the bucket counts be incorrect?

medium

A. Missing "key" field for each range

B. Ranges overlap at 18, causing double counting

C. The "field" name is invalid

D. Ranges must use "start" and "end" instead of "from" and "to"

Solution

1. Step 1: Check range boundaries for overlap

   Ranges are 0-19, 18-30, 30-50. The value 18 is included in both first (>=0 <19) and second (>=18 <30) ranges because "from" is inclusive and "to" is exclusive.

2. Step 2: Understand impact on counts

   Documents with age=18 will contribute to both buckets since Elasticsearch range aggregations place documents into all matching buckets, causing inflated counts (double counting).

3. Final Answer:

   Ranges overlap at 18, causing double counting -> Option B

4. Quick Check:

   Overlapping ranges cause docs to count in multiple buckets [OK]

Hint: Check if range edges overlap causing double counts [OK]

Common Mistakes:

• Assuming "to" is inclusive causing overlap
• Not verifying field name correctness
• Thinking "key" is mandatory for ranges

5.

You want to create a range bucket aggregation on a date field called created_at to group documents into these ranges:

• Before 2023-01-01
• From 2023-01-01 to 2023-06-30
• After 2023-06-30

Which of the following is the correct aggregation snippet?

hard

A. { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "to": "2023-06-30" } ] } }

B. { "range": { "field": "created_at", "ranges": [ { "from": "2023-01-01" }, { "to": "2023-06-30" }, { "from": "2023-06-30" } ] } }

C. { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "from": "2023-06-30" } ] } }

D. { "range": { "field": "created_at", "ranges": [ { "from": "2023-01-01" }, { "from": "2023-06-30" }, { "to": "2023-06-30" } ] } }

Solution

1. Step 1: Match ranges to requirements

   We want: before 2023-01-01 (use "to"), from 2023-01-01 to 2023-06-30 (use "from" and "to"), after 2023-06-30 (use "from").

2. Step 2: Check options for correct keys and values

   { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "from": "2023-06-30" } ] } } correctly uses "to" for before date, "from" and "to" for middle range, and "from" for after date. Others misuse keys or omit ranges.

3. Final Answer:

   { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "from": "2023-06-30" } ] } } -> Option C

4. Quick Check:

   Use "to" for before, "from" and "to" for between, "from" for after [OK]

Hint: Use "to" for before date, "from" for after date ranges [OK]

Common Mistakes:

• Using "from" without "to" for before range
• Using "to" without "from" for after range
• Mixing up date boundaries causing missing data