Stats and extended stats in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does the stats aggregation in Elasticsearch provide?

The stats aggregation calculates basic statistics like count, min, max, sum, and average for numeric fields in your data.

intermediate

Name three additional metrics provided by the extended_stats aggregation beyond basic stats.

The extended_stats aggregation provides variance, standard deviation, and sum of squares in addition to count, min, max, sum, and average.

beginner

How do you specify the field to aggregate on in a stats aggregation?

You specify the field using the field parameter inside the aggregation body, for example: { "stats": { "field": "price" } }.

intermediate

What is the difference between stats and extended_stats aggregations?

stats provides basic statistics (count, min, max, sum, avg), while extended_stats adds variance, standard deviation, and sum of squares for deeper analysis.

intermediate

Why might you use extended_stats instead of stats in Elasticsearch?

Use extended_stats when you need more detailed statistical insights like how spread out your data is (standard deviation) or variance, which helps understand data variability.

Which metric is NOT provided by the stats aggregation?

A Count

B Average

C Minimum

D Sum of squares

Sum of squares is provided only by extended_stats, not by stats.

What parameter do you use to specify the numeric field for stats aggregation?

A value

B field

C metric

D type

The field parameter tells Elasticsearch which numeric field to calculate statistics on.

Which aggregation would you use to get the standard deviation of a numeric field?

A extended_stats

B terms

C avg

D stats

extended_stats includes standard deviation, while stats does not.

If you want to know how many documents have a value in a field, which metric helps you?

A count

B sum

C min

D variance

The count metric shows how many documents have a value for the field.

Which of these is NOT a valid metric returned by extended_stats?

A Variance

B Sum

C Median

D Standard deviation

Median is not provided by extended_stats; it requires a different aggregation like percentiles.

Explain what the stats aggregation does and list the basic statistics it provides.

Think about simple summary numbers that describe a set of values.

Describe the additional insights you get from extended_stats compared to stats aggregation.

Consider how to measure how data values differ from the average.

Practice

1. What does the stats aggregation in Elasticsearch provide by default?

easy

A. Count, min, max, avg, and sum

B. Variance and standard deviation

C. Sum of squares only

D. Median and mode

Solution

1. Step 1: Understand the purpose of stats aggregation

   The stats aggregation provides basic statistical data about numeric fields.

2. Step 2: Identify the default metrics included

   By default, it returns count, min, max, avg, and sum values.

3. Final Answer:

   Count, min, max, avg, and sum -> Option A

4. Quick Check:

   Stats aggregation = basic stats [OK]

Hint: Stats aggregation gives basic stats like count and sum [OK]

Common Mistakes:

• Confusing stats with extended_stats
• Thinking stats includes variance
• Assuming median is included

2. Which of the following is the correct syntax to add an extended stats aggregation named my_stats on the field price?

easy

A. { "aggs": { "my_stats": { "extended_stats": { "field": "price" } } } }

B. { "aggs": { "my_stats": { "stats": { "field": "price" } } } }

C. { "aggs": { "my_stats": { "extended_stats": { "field_name": "price" } } } }

D. { "aggregations": { "my_stats": { "stats": { "field": "price" } } } }

Solution

1. Step 1: Check the aggregation type and field key

   The aggregation type must be extended_stats and the field key must be field.

2. Step 2: Verify the JSON structure

   The correct syntax uses aggs as the root key for aggregations, not aggregations.

3. Final Answer:

   { "aggs": { "my_stats": { "extended_stats": { "field": "price" } } } } -> Option A

4. Quick Check:

   Use extended_stats with field inside aggs [OK]

Hint: Use "aggs" and "extended_stats" with "field" key [OK]

Common Mistakes:

• Using "field_name" instead of "field"
• Using "aggregations" instead of "aggs"
• Confusing stats with extended_stats

3. Given this Elasticsearch aggregation query:

{
  "aggs": {
    "price_stats": {
      "extended_stats": {
        "field": "price"
      }
    }
  }
}

Which of the following metrics will NOT be included in the response?

medium

A. Sum of squares

B. Median

C. Standard deviation

D. Variance

Solution

1. Step 1: Identify metrics returned by extended_stats

   The extended_stats aggregation returns count, min, max, avg, sum, sum_of_squares, variance, and std_deviation.

2. Step 2: Check which metric is missing

   Median is not included in either stats or extended_stats aggregations.

3. Final Answer:

   Median -> Option B

4. Quick Check:

   Median not in extended_stats [OK]

Hint: Extended stats exclude median, include variance and std deviation [OK]

Common Mistakes:

• Assuming median is part of extended_stats
• Confusing sum_of_squares with sum
• Thinking variance is not included

4. You wrote this aggregation:

{
  "aggs": {
    "my_stats": {
      "extended_stats": {
        "field_name": "age"
      }
    }
  }
}

Why does this query fail?

medium

A. The aggregation name cannot be "my_stats"

B. The root key should be "aggregations" instead of "aggs"

C. extended_stats does not support the field "age"

D. The field key should be "field", not "field_name"

Solution

1. Step 1: Check the field key in extended_stats

   The correct key to specify the field is field, not field_name.

2. Step 2: Verify other parts of the query

   The aggregation name "my_stats" is valid, and "aggs" is the correct root key. The field "age" can be used if it exists.

3. Final Answer:

   The field key should be "field", not "field_name" -> Option D

4. Quick Check:

   Use "field" key for field name [OK]

Hint: Use "field" key, not "field_name" in aggregations [OK]

Common Mistakes:

• Using "field_name" instead of "field"
• Changing aggregation root key incorrectly
• Assuming field name is invalid without checking

5. You want to find the average price and also understand the price spread using variance and standard deviation in one query. Which aggregation setup is best?

hard

A. Use stats aggregation on price

B. Use percentiles aggregation on price

C. Use extended_stats aggregation on price

D. Use terms aggregation on price

Solution

1. Step 1: Identify metrics needed

   You want average, variance, and standard deviation, which describe spread and central tendency.

2. Step 2: Choose aggregation that provides all metrics

   extended_stats provides avg, variance, std_deviation, sum_of_squares, and more in one aggregation.

3. Step 3: Compare other options

   stats lacks variance and std deviation; terms groups data; percentiles gives percentile info, not variance.

4. Final Answer:

   Use extended_stats aggregation on price -> Option C

5. Quick Check:

   Extended stats = avg + variance + std deviation [OK]

Hint: Extended stats give avg and spread metrics together [OK]

Common Mistakes:

• Using stats and missing variance
• Confusing terms with stats
• Choosing percentiles for variance