Range buckets in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a range bucket aggregation named "price_ranges".

Elasticsearch

{
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 100 },
          { "from": 100, "to": 200 },
          { "from": 200 }
        ]
      }
    }
  },
  "size": [1]
}

Drag options to blanks, or click blank then click option'

A0

B10

C100

D1

Attempts:

3 left

💡 Hint

Common Mistakes

Setting "size" to a positive number returns documents, not just aggregation results.

Omitting "size" returns default 10 documents, which is unnecessary here.

Setting "size" to 0 tells Elasticsearch not to return any hits, only aggregation results.

2fill in blank

medium

Complete the code to add a sub-aggregation "avg_price" that calculates the average price within each range bucket.

Elasticsearch

{
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 100 },
          { "from": 100, "to": 200 },
          { "from": 200 }
        ]
      },
      "aggs": {
        "avg_price": {
          "[1]": {
            "field": "price"
          }
        }
      }
    }
  },
  "size": 0
}

Drag options to blanks, or click blank then click option'

Asum

Bavg

Cmax

Dmin

Attempts:

3 left

💡 Hint

Common Mistakes

Using "sum" instead of "avg" returns total sum, not average.

Using "max" or "min" returns maximum or minimum values, not average.

The "avg" aggregation calculates the average value of a numeric field.

3fill in blank

hard

Fix the error in the range bucket definition by completing the missing key.

Elasticsearch

{
  "aggs": {
    "age_ranges": {
      "range": {
        "[1]": "age",
        "ranges": [
          { "to": 20 },
          { "from": 20, "to": 40 },
          { "from": 40 }
        ]
      }
    }
  },
  "size": 0
}

Drag options to blanks, or click blank then click option'

Avalue

Branges

Cfield

Dkey

Attempts:

3 left

💡 Hint

Common Mistakes

Using "ranges" as a key for the field causes an error.

Using "key" or "value" are not valid keys for this purpose.

The key "field" specifies which field to use for the range aggregation.

4fill in blank

hard

Fill both blanks to create a range bucket aggregation on "weight" with two buckets: less than 50 and 50 or more.

Elasticsearch

{
  "aggs": {
    "weight_ranges": {
      "range": {
        "[1]": "weight",
        "[2]": [
          { "to": 50 },
          { "from": 50 }
        ]
      }
    }
  },
  "size": 0
}

Drag options to blanks, or click blank then click option'

Afield

Branges

Cbuckets

Dvalues

Attempts:

3 left

💡 Hint

Common Mistakes

Using "buckets" or "values" instead of "ranges" causes errors.

Swapping the keys "field" and "ranges" is invalid.

"field" specifies the field to aggregate on, and "ranges" defines the bucket boundaries.

5fill in blank

hard

Fill all three blanks to create a range bucket aggregation on "temperature" with buckets for below 0, 0 to 30, and above 30, and add a sub-aggregation "max_temp" to find the maximum temperature in each bucket.

Elasticsearch

{
  "aggs": {
    "temp_ranges": {
      "range": {
        "[1]": "temperature",
        "[2]": [
          { "to": 0 },
          { "from": 0, "to": 30 },
          { "from": 30 }
        ]
      },
      "aggs": {
        "max_temp": {
          "[3]": {
            "field": "temperature"
          }
        }
      }
    }
  },
  "size": 0
}

Drag options to blanks, or click blank then click option'

Afield

Branges

Cmax

Davg

Attempts:

3 left

💡 Hint

Common Mistakes

Using "avg" instead of "max" for the sub-aggregation.

Swapping "field" and "ranges" keys.

Omitting the sub-aggregation key.

"field" specifies the field for the range aggregation, "ranges" defines the buckets, and "max" finds the maximum value in each bucket.

Practice

1.

What is the main purpose of range buckets in Elasticsearch aggregations?

easy

A. To update documents in the index

B. To sort documents alphabetically

C. To filter documents by exact match

D. To group documents into specified numeric or date ranges

Solution

1. Step 1: Understand range buckets concept

   Range buckets group documents based on numeric or date values falling within specified ranges.

2. Step 2: Compare options

   Only To group documents into specified numeric or date ranges describes grouping by ranges. Others describe unrelated operations.

3. Final Answer:

   To group documents into specified numeric or date ranges -> Option D

4. Quick Check:

   Range buckets = grouping by ranges [OK]

Hint: Range buckets group data by intervals, not sorting or filtering [OK]

Common Mistakes:

• Confusing range buckets with sorting
• Thinking range buckets filter exact matches
• Assuming range buckets update documents

2.

Which of the following is the correct syntax snippet to define a range bucket in Elasticsearch?

{ "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 }, { "from": 50, "to": 100 } ] }}

easy

A. { "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 } ] }}

B. { "range": { "field": "price", "buckets": [ { "from": 0, "to": 50 } ] }}

C. { "range": { "field": "price", "ranges": [ { "start": 0, "end": 50 } ] }}

D. { "range": { "field": "price", "intervals": [ { "from": 0, "to": 50 } ] }}

Solution

1. Step 1: Check correct keys for range buckets

   Elasticsearch uses "ranges" array with objects having "from" and "to" keys.

2. Step 2: Compare options

   Only { "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 } ] }} uses "ranges" with "from" and "to" correctly. Others use incorrect keys like "start", "buckets", or "intervals".

3. Final Answer:

   { "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 } ] }} -> Option A

4. Quick Check:

   Use "ranges" with "from" and "to" keys [OK]

Hint: Use "ranges" array with "from" and "to" keys for range buckets [OK]

Common Mistakes:

• Using "start" and "end" instead of "from" and "to"
• Using wrong key names like "buckets" or "intervals"
• Placing ranges outside the "range" object

3.

Given this aggregation query snippet, what will be the count of documents in the bucket with from: 10 and to: 20?

{
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 10 },
          { "from": 10, "to": 20 },
          { "from": 20 }
        ]
      }
    }
  }
}

Assume documents have prices: [5, 7, 10, 15, 18, 20, 25]

medium

A. 3

B. 2

C. 4

D. 1

Solution

1. Step 1: Identify which prices fall into the 10 to 20 range

   Prices are [5,7,10,15,18,20,25]. The bucket is from 10 (inclusive) to 20 (exclusive). So prices 10, 15, 18 count. Price 20 is excluded.

2. Step 2: Count matching documents

   Matching prices: 10, 15, 18 -> 3 documents.

3. Final Answer:

   3 -> Option A

4. Quick Check:

   Prices ≥10 and <20 count = 3 [OK]

Hint: Ranges include from (inclusive), exclude to (exclusive) by default [OK]

Common Mistakes:

• Counting price 20 in the 10-20 bucket
• Confusing inclusive/exclusive range ends
• Counting prices below 10 in this bucket

4.

Identify the error in this range bucket aggregation query:

{
  "aggs": {
    "age_ranges": {
      "range": {
        "field": "age",
        "ranges": [
          { "from": 0, "to": 19 },
          { "from": 18, "to": 30 },
          { "from": 30, "to": 50 }
        ]
      }
    }
  }
}

Why might the bucket counts be incorrect?

medium

A. Missing "key" field for each range

B. Ranges overlap at 18, causing double counting

C. The "field" name is invalid

D. Ranges must use "start" and "end" instead of "from" and "to"

Solution

1. Step 1: Check range boundaries for overlap

   Ranges are 0-19, 18-30, 30-50. The value 18 is included in both first (>=0 <19) and second (>=18 <30) ranges because "from" is inclusive and "to" is exclusive.

2. Step 2: Understand impact on counts

   Documents with age=18 will contribute to both buckets since Elasticsearch range aggregations place documents into all matching buckets, causing inflated counts (double counting).

3. Final Answer:

   Ranges overlap at 18, causing double counting -> Option B

4. Quick Check:

   Overlapping ranges cause docs to count in multiple buckets [OK]

Hint: Check if range edges overlap causing double counts [OK]

Common Mistakes:

• Assuming "to" is inclusive causing overlap
• Not verifying field name correctness
• Thinking "key" is mandatory for ranges

5.

You want to create a range bucket aggregation on a date field called created_at to group documents into these ranges:

• Before 2023-01-01
• From 2023-01-01 to 2023-06-30
• After 2023-06-30

Which of the following is the correct aggregation snippet?

hard

A. { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "to": "2023-06-30" } ] } }

B. { "range": { "field": "created_at", "ranges": [ { "from": "2023-01-01" }, { "to": "2023-06-30" }, { "from": "2023-06-30" } ] } }

C. { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "from": "2023-06-30" } ] } }

D. { "range": { "field": "created_at", "ranges": [ { "from": "2023-01-01" }, { "from": "2023-06-30" }, { "to": "2023-06-30" } ] } }

Solution

1. Step 1: Match ranges to requirements

   We want: before 2023-01-01 (use "to"), from 2023-01-01 to 2023-06-30 (use "from" and "to"), after 2023-06-30 (use "from").

2. Step 2: Check options for correct keys and values

   { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "from": "2023-06-30" } ] } } correctly uses "to" for before date, "from" and "to" for middle range, and "from" for after date. Others misuse keys or omit ranges.

3. Final Answer:

   { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "from": "2023-06-30" } ] } } -> Option C

4. Quick Check:

   Use "to" for before, "from" and "to" for between, "from" for after [OK]

Hint: Use "to" for before date, "from" for after date ranges [OK]

Common Mistakes:

• Using "from" without "to" for before range
• Using "to" without "from" for after range
• Mixing up date boundaries causing missing data