Range buckets in Elasticsearch - Step-by-Step Execution

Concept Flow - Range buckets

Start: Define range buckets

↓

Input data documents

↓

Check each document's field value

↓

Compare value to each range bucket

↓

Assign document to matching bucket(s)

↓

Count documents per bucket

↓

Return buckets with counts

Range buckets group documents by checking if their field values fall within specified numeric ranges, then count how many documents fit each range.

Execution Sample

Elasticsearch

{
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          {"to": 100},
          {"from": 100, "to": 200},
          {"from": 200}
        ]
      }
    }
  }
}

This aggregation groups documents by their 'price' field into three ranges: less than 100, 100 to 200, and greater than or equal to 200.

Execution Table

Step	Document price	Check range <100	Check range 100-200	Check range >=200	Bucket assigned
1	50	True	False	False	Bucket 1 (<100)
2	150	False	True	False	Bucket 2 (100-200)
3	250	False	False	True	Bucket 3 (>=200)
4	100	False	True	False	Bucket 2 (100-200)
5	99	True	False	False	Bucket 1 (<100)
6	200	False	True	False	Bucket 2 (100-200)
Exit	-	-	-	-	All documents processed

💡 All documents checked and assigned to their respective range buckets.

Variable Tracker

Variable	Start	After Doc 1	After Doc 2	After Doc 3	After Doc 4	After Doc 5	After Doc 6	Final
Bucket 1 count	0	1	1	1	1	2	2	2
Bucket 2 count	0	0	1	1	2	2	3	3
Bucket 3 count	0	0	0	1	1	1	1	1

Key Moments - 2 Insights

Why does the document with price 100 go into the 100-200 bucket and not the <100 bucket?

Because the <100 bucket includes prices strictly less than 100, so 100 is not included there. The 100-200 bucket includes prices from 100 up to 200, so 100 fits there as shown in execution_table row 4.

Can a document belong to more than one range bucket?

Yes, a document can belong to more than one range bucket if it falls into multiple ranges (such as overlapping ranges). However, in this example, the ranges are non-overlapping, so each document matches only one bucket as seen in the execution_table.

Visual Quiz - 3 Questions

Look at the execution table, what is the bucket assigned for a document with price 99?

A Bucket 2 (100-200)

B Bucket 1 (<100)

C Bucket 3 (>=200)

D No bucket assigned

💡 Hint

Check row 5 in the execution_table where price 99 is assigned to Bucket 1.

At which step does the bucket 3 count increase for the first time?

A After Document 3

B After Document 4

C After Document 1

D After Document 6

💡 Hint

Look at variable_tracker row for Bucket 3 count; it increases from 0 to 1 after Document 3.

If the range for bucket 2 changed to from 101 to 200, where would the document with price 100 be assigned?

A Bucket 3 (>=200)

B Bucket 2 (101-200)

C No bucket assigned

D Bucket 1 (<100)

💡 Hint

Check the ranges in execution_table and consider that 100 is not in <100 or 101-200, so no bucket matches.

Concept Snapshot

Range buckets group documents by numeric field ranges.
Define ranges with 'from' and/or 'to' values.
Documents assigned to all matching ranges.
Counts show how many documents per bucket.
Ranges should not overlap for clear grouping.

Full Transcript

Range buckets in Elasticsearch group documents by checking if their numeric field values fall within specified ranges. The process starts by defining the ranges, then each document's field value is checked against these ranges. Documents are assigned to all matching buckets, and counts are kept for each bucket. For example, documents with price less than 100 go to the first bucket, prices between 100 and 200 to the second, and prices 200 or more to the third. This grouping helps analyze data distribution by numeric intervals.

Practice

1.

What is the main purpose of range buckets in Elasticsearch aggregations?

easy

A. To update documents in the index

B. To sort documents alphabetically

C. To filter documents by exact match

D. To group documents into specified numeric or date ranges

Solution

1. Step 1: Understand range buckets concept

   Range buckets group documents based on numeric or date values falling within specified ranges.

2. Step 2: Compare options

   Only To group documents into specified numeric or date ranges describes grouping by ranges. Others describe unrelated operations.

3. Final Answer:

   To group documents into specified numeric or date ranges -> Option D

4. Quick Check:

   Range buckets = grouping by ranges [OK]

Hint: Range buckets group data by intervals, not sorting or filtering [OK]

Common Mistakes:

• Confusing range buckets with sorting
• Thinking range buckets filter exact matches
• Assuming range buckets update documents

2.

Which of the following is the correct syntax snippet to define a range bucket in Elasticsearch?

{ "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 }, { "from": 50, "to": 100 } ] }}

easy

A. { "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 } ] }}

B. { "range": { "field": "price", "buckets": [ { "from": 0, "to": 50 } ] }}

C. { "range": { "field": "price", "ranges": [ { "start": 0, "end": 50 } ] }}

D. { "range": { "field": "price", "intervals": [ { "from": 0, "to": 50 } ] }}

Solution

1. Step 1: Check correct keys for range buckets

   Elasticsearch uses "ranges" array with objects having "from" and "to" keys.

2. Step 2: Compare options

   Only { "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 } ] }} uses "ranges" with "from" and "to" correctly. Others use incorrect keys like "start", "buckets", or "intervals".

3. Final Answer:

   { "range": { "field": "price", "ranges": [ { "from": 0, "to": 50 } ] }} -> Option A

4. Quick Check:

   Use "ranges" with "from" and "to" keys [OK]

Hint: Use "ranges" array with "from" and "to" keys for range buckets [OK]

Common Mistakes:

• Using "start" and "end" instead of "from" and "to"
• Using wrong key names like "buckets" or "intervals"
• Placing ranges outside the "range" object

3.

Given this aggregation query snippet, what will be the count of documents in the bucket with from: 10 and to: 20?

{
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 10 },
          { "from": 10, "to": 20 },
          { "from": 20 }
        ]
      }
    }
  }
}

Assume documents have prices: [5, 7, 10, 15, 18, 20, 25]

medium

A. 3

B. 2

C. 4

D. 1

Solution

1. Step 1: Identify which prices fall into the 10 to 20 range

   Prices are [5,7,10,15,18,20,25]. The bucket is from 10 (inclusive) to 20 (exclusive). So prices 10, 15, 18 count. Price 20 is excluded.

2. Step 2: Count matching documents

   Matching prices: 10, 15, 18 -> 3 documents.

3. Final Answer:

   3 -> Option A

4. Quick Check:

   Prices ≥10 and <20 count = 3 [OK]

Hint: Ranges include from (inclusive), exclude to (exclusive) by default [OK]

Common Mistakes:

• Counting price 20 in the 10-20 bucket
• Confusing inclusive/exclusive range ends
• Counting prices below 10 in this bucket

4.

Identify the error in this range bucket aggregation query:

{
  "aggs": {
    "age_ranges": {
      "range": {
        "field": "age",
        "ranges": [
          { "from": 0, "to": 19 },
          { "from": 18, "to": 30 },
          { "from": 30, "to": 50 }
        ]
      }
    }
  }
}

Why might the bucket counts be incorrect?

medium

A. Missing "key" field for each range

B. Ranges overlap at 18, causing double counting

C. The "field" name is invalid

D. Ranges must use "start" and "end" instead of "from" and "to"

Solution

1. Step 1: Check range boundaries for overlap

   Ranges are 0-19, 18-30, 30-50. The value 18 is included in both first (>=0 <19) and second (>=18 <30) ranges because "from" is inclusive and "to" is exclusive.

2. Step 2: Understand impact on counts

   Documents with age=18 will contribute to both buckets since Elasticsearch range aggregations place documents into all matching buckets, causing inflated counts (double counting).

3. Final Answer:

   Ranges overlap at 18, causing double counting -> Option B

4. Quick Check:

   Overlapping ranges cause docs to count in multiple buckets [OK]

Hint: Check if range edges overlap causing double counts [OK]

Common Mistakes:

• Assuming "to" is inclusive causing overlap
• Not verifying field name correctness
• Thinking "key" is mandatory for ranges

5.

You want to create a range bucket aggregation on a date field called created_at to group documents into these ranges:

• Before 2023-01-01
• From 2023-01-01 to 2023-06-30
• After 2023-06-30

Which of the following is the correct aggregation snippet?

hard

A. { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "to": "2023-06-30" } ] } }

B. { "range": { "field": "created_at", "ranges": [ { "from": "2023-01-01" }, { "to": "2023-06-30" }, { "from": "2023-06-30" } ] } }

C. { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "from": "2023-06-30" } ] } }

D. { "range": { "field": "created_at", "ranges": [ { "from": "2023-01-01" }, { "from": "2023-06-30" }, { "to": "2023-06-30" } ] } }

Solution

1. Step 1: Match ranges to requirements

   We want: before 2023-01-01 (use "to"), from 2023-01-01 to 2023-06-30 (use "from" and "to"), after 2023-06-30 (use "from").

2. Step 2: Check options for correct keys and values

   { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "from": "2023-06-30" } ] } } correctly uses "to" for before date, "from" and "to" for middle range, and "from" for after date. Others misuse keys or omit ranges.

3. Final Answer:

   { "range": { "field": "created_at", "ranges": [ { "to": "2023-01-01" }, { "from": "2023-01-01", "to": "2023-06-30" }, { "from": "2023-06-30" } ] } } -> Option C

4. Quick Check:

   Use "to" for before, "from" and "to" for between, "from" for after [OK]

Hint: Use "to" for before date, "from" for after date ranges [OK]

Common Mistakes:

• Using "from" without "to" for before range
• Using "to" without "from" for after range
• Mixing up date boundaries causing missing data