Why aggregations summarize data in Elasticsearch - See It in Action

Why aggregations summarize data

📖 Scenario: You work at a bookstore that uses Elasticsearch to store sales data. You want to understand how many books were sold in each genre to make better stock decisions.

🎯 Goal: Build an Elasticsearch query that uses aggregations to summarize the total number of books sold per genre.

📋 What You'll Learn

Create an Elasticsearch index data structure with sample sales data

Add a filter to select only sales from the last month

Use a terms aggregation on the genre field to group sales

Use a sum aggregation on the copies_sold field to get total sales per genre

Print the aggregation results

💡 Why This Matters

🌍 Real World

Aggregations help businesses quickly summarize large amounts of data, like total sales per category, without manually counting each record.

💼 Career

Understanding aggregations is essential for data analysts and backend developers working with Elasticsearch to create reports and dashboards.

1

DATA SETUP: Create sample sales data

Create a variable called sales_data that contains a list of dictionaries. Each dictionary should have these exact keys and values: {"genre": "fiction", "copies_sold": 10}, {"genre": "non-fiction", "copies_sold": 5}, {"genre": "fiction", "copies_sold": 7}, {"genre": "science", "copies_sold": 3}.

Elasticsearch

# Create the sales_data list with the exact entries
# Your code here

Hint

Use a list with dictionaries exactly as shown.

2

CONFIGURATION: Add a filter for recent sales

Create a variable called query that contains a dictionary with a range filter on the sale_date field to select sales from the last 30 days. Use the exact key gte with value "now-30d/d".

Elasticsearch

sales_data = [
    {"genre": "fiction", "copies_sold": 10},
    {"genre": "non-fiction", "copies_sold": 5},
    {"genre": "fiction", "copies_sold": 7},
    {"genre": "science", "copies_sold": 3}
]
# Create the query dictionary with a range filter on sale_date for last 30 days
# Your code here

Hint

Use a dictionary with keys range, sale_date, and gte.

3

CORE LOGIC: Build the aggregation query

Create a variable called agg_query that contains a dictionary with a terms aggregation on the genre field named genres, and inside it a sum aggregation on the copies_sold field named total_copies.

Elasticsearch

sales_data = [
    {"genre": "fiction", "copies_sold": 10},
    {"genre": "non-fiction", "copies_sold": 5},
    {"genre": "fiction", "copies_sold": 7},
    {"genre": "science", "copies_sold": 3}
]

query = {
    "range": {
        "sale_date": {
            "gte": "now-30d/d"
        }
    }
}

# Create agg_query with terms aggregation on genre named 'genres' and sum aggregation on copies_sold named 'total_copies'
# Your code here

Hint

Use nested dictionaries for terms and sum aggregations exactly as shown.

4

OUTPUT: Print the aggregation results

Write a print statement that outputs the string "Aggregation query:" followed by the agg_query variable.

Elasticsearch

Hint

Use print("Aggregation query:", agg_query) exactly.

Practice

1. What is the main purpose of aggregations in Elasticsearch?

easy

A. To delete documents from the index

B. To summarize data like totals, averages, and counts

C. To update the mapping of fields

D. To create new indexes

Solution

1. Step 1: Understand what aggregations do

   Aggregations are used to get summaries such as totals, averages, and counts from data.

2. Step 2: Compare with other options

   Deleting documents, updating mappings, and creating indexes are not related to summarizing data.

3. Final Answer:

   To summarize data like totals, averages, and counts -> Option B

4. Quick Check:

   Aggregations summarize data = A [OK]

Hint: Aggregations summarize data, not modify it [OK]

Common Mistakes:

• Confusing aggregations with data deletion
• Thinking aggregations change index structure
• Mixing aggregations with indexing operations

2. Which part of an Elasticsearch query contains aggregations?

easy

A. aggs

B. query

C. filter

D. sort

Solution

1. Step 1: Identify the query structure

   Elasticsearch queries have different parts like query, aggs, filter, and sort.

2. Step 2: Locate where aggregations go

   Aggregations are always written inside the aggs section to summarize data.

3. Final Answer:

   aggs -> Option A

4. Quick Check:

   Aggregations inside aggs = A [OK]

Hint: Aggregations live inside the aggs section [OK]

Common Mistakes:

• Putting aggregations inside query or filter
• Confusing aggs with sort
• Missing the aggs keyword

3. Given this aggregation query snippet, what does it calculate?

{"aggs": {"total_sales": {"sum": {"field": "price"}}}}

medium

A. Sums all values in the price field

B. Calculates the average price

C. Finds the maximum price

D. Counts the number of documents

Solution

1. Step 1: Read the aggregation type

   The aggregation uses sum on the field price.

2. Step 2: Understand what sum does

   Sum adds all values in the specified field across documents.

3. Final Answer:

   Sums all values in the price field -> Option A

4. Quick Check:

   sum aggregation = D [OK]

Hint: Sum adds all values in a field [OK]

Common Mistakes:

• Confusing sum with count or average
• Thinking sum finds max value
• Ignoring the field name

4. This aggregation query returns an error. What is the mistake?

{"aggs": {"avg_price": {"average": {"field": "price"}}}}

medium

A. The aggs keyword is misspelled

B. The field name 'price' is invalid

C. Aggregations cannot use numeric fields

D. The aggregation type should be 'avg', not 'average'

Solution

1. Step 1: Check aggregation type spelling

   The correct aggregation for average is avg, not average.

2. Step 2: Validate other parts

   The field name and aggs keyword are correct, and numeric fields are allowed.

3. Final Answer:

   The aggregation type should be 'avg', not 'average' -> Option D

4. Quick Check:

   Use 'avg' for average aggregation = C [OK]

Hint: Use 'avg' keyword, not 'average' [OK]

Common Mistakes:

• Using 'average' instead of 'avg'
• Assuming field name causes error
• Thinking aggs is misspelled

5. You want to find the average price of products but only for those with stock greater than 10. Which aggregation setup is correct?

hard

A. {"aggs": {"avg_price": {"avg": {"field": "price", "gt": 10}}}}

B. {"query": {"term": {"stock": 10}}, "aggs": {"avg_price": {"avg": {"field": "price"}}}}

C. {"query": {"range": {"stock": {"gt": 10}}}, "aggs": {"avg_price": {"avg": {"field": "price"}}}}

D. {"aggs": {"avg_price": {"avg": {"field": "price"}}}, "filter": {"range": {"stock": {"gt": 10}}}}

Solution

1. Step 1: Understand filtering before aggregation

   To filter documents before aggregation, use a query with a range filter on stock > 10.

2. Step 2: Check aggregation syntax

   The aggregation should be inside aggs with avg on the price field.

3. Step 3: Evaluate options

   {"query": {"range": {"stock": {"gt": 10}}}, "aggs": {"avg_price": {"avg": {"field": "price"}}}} correctly filters with query and then aggregates. {"aggs": {"avg_price": {"avg": {"field": "price", "gt": 10}}}} wrongly puts filter inside aggregation. {"query": {"term": {"stock": 10}}, "aggs": {"avg_price": {"avg": {"field": "price"}}}} filters exact stock=10, not greater. {"aggs": {"avg_price": {"avg": {"field": "price"}}}, "filter": {"range": {"stock": {"gt": 10}}}} misplaces filter outside query.

4. Final Answer:

   {"query": {"range": {"stock": {"gt": 10}}}, "aggs": {"avg_price": {"avg": {"field": "price"}}}} -> Option C

5. Quick Check:

   Filter in query, aggregation in aggs = B [OK]

Hint: Filter in query, aggregate in aggs section [OK]

Common Mistakes:

• Putting filters inside aggregation incorrectly
• Using term filter instead of range for greater than
• Placing filter outside query block