{"id":1897,"date":"2016-07-19T14:00:53","date_gmt":"2016-07-19T13:00:53","guid":{"rendered":"https:\/\/www.inovex.de\/\/?p=1897"},"modified":"2026-03-17T07:59:28","modified_gmt":"2026-03-17T06:59:28","slug":"drastic-elastic-part-2","status":"publish","type":"post","link":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/","title":{"rendered":"Drastic Elastic [Part 2]: The aggregation framework"},"content":{"rendered":"<p>Following from my <a href=\"https:\/\/www.inovex.de\/\/drastic-elastic-part-1\/\" target=\"_blank\" rel=\"noopener\">earlier article<\/a> on elasticsearch-as-a-database, we will now take a look at the aggregation framework.<!--more--><\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_79_2 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\"><p class=\"ez-toc-title\" style=\"cursor:inherit\"><\/p>\n<\/div><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#Aggregations\" >Aggregations<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#Basic-concepts\" >Basic concepts<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#Aggregate\" >Aggregate<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#Cluster-vs-External-%E2%80%A6-what-does-this-mean\" >Cluster vs. External &#8230; what does this mean?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#Aggregations-Lessons-learned\" >Aggregations: Lessons learned<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#Read-on-%E2%80%A6\" >Read on &#8230;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#Join-us\" >Join us!<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#Read-the-complete-series\" >Read the complete series<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Aggregations\"><\/span>Aggregations<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>But first the bad news \u2013 we have to admit, we abused this feature &#8230; big time. The documentation illustrates use of the aggregation framework for things such as summary, or top X, queries (&#8222;give me the top 10 best-selling cars by country&#8220;), but aggregating data over an entire index is something else entirely.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Basic-concepts\"><\/span>Basic concepts<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Aggregations return key\/value pairs for each aggregation level, together with one or more aggregated metric (max, min, sum,..). They can be nested (see next section), and cannot be used on analyzed fields. A simple aggregation over all types held in an index would look like this:<\/p>\n<pre class=\"lang:sh decode:true \">curl -XGET 'localhost:9200\/myIndex\/_search?search_type=count&amp;pretty' -d '{\r\n\r\n    \"aggs\": {\r\n\r\n        \"count_by_type\": {\r\n\r\n            \"terms\": {\r\n\r\n                \"field\": \"_type\"\r\n\r\n            }\r\n\r\n        }\r\n\r\n    }\r\n\r\n}'<\/pre>\n<p>which is comparable to a simple group-by query in a relational database:<\/p>\n<pre class=\"lang:mysql decode:true \">select someColumn1, count(*) from myTable group by someColumn1<\/pre>\n<p>It is possible to nest such queries in elasticsearch (just as one could do with a RDBMS), so that a group operation such as<\/p>\n<pre class=\"lang:mysql decode:true \">select someColumn1, someColumn2, someColumn3, count(*) from myTable group by someColumn1, someColumn2, someColumn3<\/pre>\n<p>can be achieved by nesting aggregations. But your memory could explode if this is done excessively.<\/p>\n<p>So if you should not nest aggregations, but you wish to wish to group on more one column, what are the alternatives? Our approach was to combine fields needed for &#8222;nested&#8220; aggregations in a single, composite field in our bulk import step, so that we could aggregate on this single field, but also parse out individual fields before persisting the aggregated result. e.g.<\/p>\n<ol>\n<li>on bulk import, write a composite column made up of three columns like this (using a suitable delimiter)\n<ul>\n<li>field1: &#8222;value1&#8220;<\/li>\n<li>field2: &#8222;value2&#8220;<\/li>\n<li>field3: &#8222;value3&#8220;\n<ul>\n<li>groupField:&#8220;value1;value2;value3&#8243;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>aggregate on groupField<\/li>\n<li>having accessed the aggregation result, split the key (groupField) back into three individual columns (field1, field2, field3) and then write row back into a new index (one for holding aggregated results) in elasticsearch.<\/li>\n<\/ol>\n<p>In this way we can be flexible in the way we aggregate without placing an impossible burden on memory. In fact, we are able to aggregate over entire indexes (often holding 100s of thousands of documents) at regular intervals without disturbing the bulk imports which take place every 5 minutes. We took the precaution of carrying out aggregations on 2 dedicated client nodes (that are not subject to bulk import loads).<\/p>\n<p>Example:<\/p>\n<pre class=\"lang:sh decode:true \">curl -XGET 'localhost:9200\/myIndex\/myType\/_search?pretty' -d '{\r\n\r\n\t\"_source\": [\"group_field\", \"fieldToAggregate\"],\r\n\r\n\t\"size\": 1000,\r\n\r\n\t\"query\": {\r\n\r\n\t\t\"filtered\": {\r\n\r\n\t\t\t\"query\": {\r\n\r\n\t\t\t\t\"term\": {\r\n\r\n\t\t\t\t\t\"somefield\": \"value1\" &lt;== aggregations can be combined with filter terms\r\n\r\n\t\t\t\t}\r\n\r\n\t\t\t}\r\n\r\n\t\t}\r\n\r\n\t},\r\n\r\n\t\"aggs\": {\r\n\r\n\t\t\"grp\": {\r\n\r\n\t\t\t\"terms\": {\r\n\r\n\t\t\t\t\"field\": \"group_field\",\r\n\r\n\t\t\t\t\"size\": 0\r\n\r\n\t\t\t},\r\n\r\n\t\t\t\"aggs\": {\r\n\r\n\t\t\t\t\"sum_fieldToAggregate\": {\r\n\r\n\t\t\t\t\t\"sum\": {\r\n\r\n\t\t\t\t\t\t\"field\": \"fieldToAggregate\"\r\n\r\n\t\t\t\t\t}\r\n\r\n\t\t\t\t},\r\n\r\n\t\t\t\t\"max_fieldToAggregate\": {\r\n\r\n\t\t\t\t\t\"max\": {\r\n\r\n\t\t\t\t\t\t\"field\": \"fieldToAggregate\"\r\n\r\n\t\t\t\t\t}\r\n\r\n\t\t\t\t},\r\n\r\n\t\t\t\t\"min_fieldToAggregate\": {\r\n\r\n\t\t\t\t\t\"min\": {\r\n\r\n\t\t\t\t\t\t\"field\": \"fieldToAggregate\"\r\n\r\n\t\t\t\t\t}\r\n\r\n\t\t\t\t}\r\n\r\n\t\t\t}\r\n\r\n\t\t}\r\n\r\n\t}\r\n\r\n}'\r\n\r\n<\/pre>\n<p>The aggregation result will then look something like this:<\/p>\n<pre class=\"lang:sh decode:true \">...\r\n\r\n\"aggregations\": {\r\n\r\n\t\"grp\": {\r\n\r\n\t\t\"buckets\": [{\r\n\r\n\t\t\t\"key\": \"value1;value2;value3\",\r\n\r\n\t\t\t\"doc_count\": 1,\r\n\r\n\t\t\t\"max_fieldToAggregate\": {\r\n\r\n\t\t\t\t\"value\": 456.0\r\n\r\n\t\t\t},\r\n\r\n\t\t\t\"min_fieldToAggregate\": {\r\n\r\n\t\t\t\t\"value\": 123.0\r\n\r\n\t\t\t},\r\n\r\n\t\t\t\"sum_fieldToAggregate\": {\r\n\r\n\t\t\t\t\"value\": 640000.0\r\n\r\n\t\t\t}\r\n\r\n\t\t}]\r\n\r\n\t}\r\n\r\n}\r\n\r\n<\/pre>\n<p>where the key refers to our groupField, made of known, ordered sub-fields (which we defined on insert).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-1910\" src=\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-importer-aggregator-1024x91.png\" alt=\"drastic-elastic-importer-aggregator\" width=\"800\" height=\"71\" srcset=\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-importer-aggregator-1024x91.png 1024w, https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-importer-aggregator-300x27.png 300w, https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-importer-aggregator-768x68.png 768w, https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-importer-aggregator-1536x136.png 1536w, https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-importer-aggregator-400x35.png 400w, https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-importer-aggregator-360x32.png 360w, https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-importer-aggregator.png 1920w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"Aggregate\"><\/span>Aggregate<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li>choose either cluster- or external-aggregation mode (see below for the differences)<\/li>\n<li>data is aggregated\/grouped on identical values of the designated group field in the document, each metric (sum\/min\/max\/values-per-second etc.) is applied to this group<\/li>\n<li>the \u201ckey\u201c (=group value) is then used to define\/retrieve all fields and values needed to construct a document with the proper mapping format<\/li>\n<li>each \u201caggregate\u201c document is written to ES<\/li>\n<li>a number of rows will be chosen randomly from the aggregation list, each aggregated row being then verified by selecting all individual documents belonging to the group and calculating\/comparing metrics in line<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Cluster-vs-External-%E2%80%A6-what-does-this-mean\"><\/span>Cluster vs. External &#8230; what does this mean?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><strong>Cluster:<\/strong> Here we take advantage of ES-aggregations to return us the grouped results: ES does the heavy lifting for us, but any errors are obfuscated and hard to identify.<\/p>\n<p><strong>External:<\/strong> We fetch all data in packets via scan-and-scroll and build up our own hash table outside of ES: Errors are far easier to identify and debug\/fix, we can dispense with the group field alltogether, as it is only needed for cluster based aggregating (saving up to 50% disk space), we have to do the heavy lifting ourselves =&gt; memory\/CPU stress outside of cluster where processes cannot be run in parallel.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Aggregations-Lessons-learned\"><\/span>Aggregations: Lessons learned<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>they rock!<\/li>\n<li>do not nest them otherwise you could have issues with RAM<\/li>\n<li>take care with (but don&#8217;t necessarily avoid) setting size=0 (which aggregates over the entire index, as we did) as this was not really the intention of the engineers that designed the aggregation framework<\/li>\n<li>it is difficult to validate an aggregation result. We actually built our aggregating tool with an &#8222;external&#8220; mode, so that could scan-and-scroll all documents in an index, building up a hash table external to elasticsearch to validate results<\/li>\n<li>using &#8222;copy values&#8220; was not useful to us as it was not able to maintain a strict order of fields (this feature is intended for searching over multiple fields)<\/li>\n<li>use your own grouping column as described above<\/li>\n<li>use dedicated nodes for aggregation operations<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Read-on-%E2%80%A6\"><\/span>Read on &#8230;<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>So you&#8217;re interested in search based applications, text analytics and enterprise search solutions? Have a look at <a href=\"https:\/\/www.inovex.de\/en\/our-services\/analytics\/search\/\" target=\"_blank\" rel=\"noopener\">our website<\/a> and read about the services we offer to our customers.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Join-us\"><\/span>Join us!<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Are you looking for a job in big data processing or analytics? We&#8217;re currently hiring!<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Read-the-complete-series\"><\/span>Read the complete series<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/www.inovex.de\/drastic-elastic-part-1\/\" target=\"_blank\" rel=\"noopener\">Part 1: ElasticSearch as a Database<\/a><\/li>\n<li><a href=\"https:\/\/www.inovex.de\/drastic-elastic-part-3\/\" target=\"_blank\" rel=\"noopener\">Part 3: Cluster Setup<\/a><\/li>\n<li><a href=\"https:\/\/www.inovex.de\/drastic-elastic-part-4-aggregations-plugins\/\" target=\"_blank\" rel=\"noopener\">Part 4: Aggregations &amp; Plugins<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Following from my earlier article on elasticsearch-as-a-database, we will now take a look at the aggregation framework.<\/p>\n","protected":false},"author":49,"featured_media":1892,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"ep_exclude_from_search":false,"footnotes":""},"tags":[82],"service":[504],"coauthors":[{"id":49,"display_name":"Andrew Kenworthy","user_nicename":"akenworthy"}],"class_list":["post-1897","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","tag-search","service-search"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Drastic Elastic [Part 2]: The aggregation framework - inovex GmbH<\/title>\n<meta name=\"description\" content=\"Following from my earlier article on elasticsearch-as-a-database, we will now take a look at the aggregation framework.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Drastic Elastic [Part 2]: The aggregation framework - inovex GmbH\" \/>\n<meta property=\"og:description\" content=\"Following from my earlier article on elasticsearch-as-a-database, we will now take a look at the aggregation framework.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/\" \/>\n<meta property=\"og:site_name\" content=\"inovex GmbH\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/inovexde\" \/>\n<meta property=\"article:published_time\" content=\"2016-07-19T13:00:53+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-17T06:59:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2300\" \/>\n\t<meta property=\"og:image:height\" content=\"678\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Andrew Kenworthy\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild-1024x302.png\" \/>\n<meta name=\"twitter:creator\" content=\"@inovexgmbh\" \/>\n<meta name=\"twitter:site\" content=\"@inovexgmbh\" \/>\n<meta name=\"twitter:label1\" content=\"Verfasst von\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andrew Kenworthy\" \/>\n\t<meta name=\"twitter:label2\" content=\"Gesch\u00e4tzte Lesezeit\" \/>\n\t<meta name=\"twitter:data2\" content=\"5\u00a0Minuten\" \/>\n\t<meta name=\"twitter:label3\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data3\" content=\"Andrew Kenworthy\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/\"},\"author\":{\"name\":\"Andrew Kenworthy\",\"@id\":\"https:\/\/www.inovex.de\/de\/#\/schema\/person\/0519169c755e15b1478ccf638f16f06c\"},\"headline\":\"Drastic Elastic [Part 2]: The aggregation framework\",\"datePublished\":\"2016-07-19T13:00:53+00:00\",\"dateModified\":\"2026-03-17T06:59:28+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/\"},\"wordCount\":808,\"commentCount\":5,\"publisher\":{\"@id\":\"https:\/\/www.inovex.de\/de\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild.png\",\"keywords\":[\"Search\"],\"articleSection\":[\"Analytics\",\"English Content\",\"General\"],\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/\",\"url\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/\",\"name\":\"Drastic Elastic [Part 2]: The aggregation framework - inovex GmbH\",\"isPartOf\":{\"@id\":\"https:\/\/www.inovex.de\/de\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild.png\",\"datePublished\":\"2016-07-19T13:00:53+00:00\",\"dateModified\":\"2026-03-17T06:59:28+00:00\",\"description\":\"Following from my earlier article on elasticsearch-as-a-database, we will now take a look at the aggregation framework.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#breadcrumb\"},\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#primaryimage\",\"url\":\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild.png\",\"contentUrl\":\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild.png\",\"width\":2300,\"height\":678,\"caption\":\"Drastic Elastic Logo\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.inovex.de\/de\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Drastic Elastic [Part 2]: The aggregation framework\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.inovex.de\/de\/#website\",\"url\":\"https:\/\/www.inovex.de\/de\/\",\"name\":\"inovex GmbH\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.inovex.de\/de\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.inovex.de\/de\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"de\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.inovex.de\/de\/#organization\",\"name\":\"inovex GmbH\",\"url\":\"https:\/\/www.inovex.de\/de\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/www.inovex.de\/de\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.inovex.de\/wp-content\/uploads\/2021\/03\/inovex-logo-16-9-1.png\",\"contentUrl\":\"https:\/\/www.inovex.de\/wp-content\/uploads\/2021\/03\/inovex-logo-16-9-1.png\",\"width\":1921,\"height\":1081,\"caption\":\"inovex GmbH\"},\"image\":{\"@id\":\"https:\/\/www.inovex.de\/de\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/inovexde\",\"https:\/\/x.com\/inovexgmbh\",\"https:\/\/www.instagram.com\/inovexlife\/\",\"https:\/\/www.linkedin.com\/company\/inovex\",\"https:\/\/www.youtube.com\/channel\/UC7r66GT14hROB_RQsQBAQUQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.inovex.de\/de\/#\/schema\/person\/0519169c755e15b1478ccf638f16f06c\",\"name\":\"Andrew Kenworthy\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/www.inovex.de\/de\/#\/schema\/person\/image\/7397755342ed757eeb6b1d51f16a4044\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c7a29df25f27010b3c581f97c66a52694571cfa2f9c9b79049542969194fbdd3?s=96&d=retro&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c7a29df25f27010b3c581f97c66a52694571cfa2f9c9b79049542969194fbdd3?s=96&d=retro&r=g\",\"caption\":\"Andrew Kenworthy\"},\"url\":\"https:\/\/www.inovex.de\/de\/blog\/author\/akenworthy\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Drastic Elastic [Part 2]: The aggregation framework - inovex GmbH","description":"Following from my earlier article on elasticsearch-as-a-database, we will now take a look at the aggregation framework.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/","og_locale":"de_DE","og_type":"article","og_title":"Drastic Elastic [Part 2]: The aggregation framework - inovex GmbH","og_description":"Following from my earlier article on elasticsearch-as-a-database, we will now take a look at the aggregation framework.","og_url":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/","og_site_name":"inovex GmbH","article_publisher":"https:\/\/www.facebook.com\/inovexde","article_published_time":"2016-07-19T13:00:53+00:00","article_modified_time":"2026-03-17T06:59:28+00:00","og_image":[{"width":2300,"height":678,"url":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild.png","type":"image\/png"}],"author":"Andrew Kenworthy","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild-1024x302.png","twitter_creator":"@inovexgmbh","twitter_site":"@inovexgmbh","twitter_misc":{"Verfasst von":"Andrew Kenworthy","Gesch\u00e4tzte Lesezeit":"5\u00a0Minuten","Written by":"Andrew Kenworthy"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#article","isPartOf":{"@id":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/"},"author":{"name":"Andrew Kenworthy","@id":"https:\/\/www.inovex.de\/de\/#\/schema\/person\/0519169c755e15b1478ccf638f16f06c"},"headline":"Drastic Elastic [Part 2]: The aggregation framework","datePublished":"2016-07-19T13:00:53+00:00","dateModified":"2026-03-17T06:59:28+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/"},"wordCount":808,"commentCount":5,"publisher":{"@id":"https:\/\/www.inovex.de\/de\/#organization"},"image":{"@id":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild.png","keywords":["Search"],"articleSection":["Analytics","English Content","General"],"inLanguage":"de","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/","url":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/","name":"Drastic Elastic [Part 2]: The aggregation framework - inovex GmbH","isPartOf":{"@id":"https:\/\/www.inovex.de\/de\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#primaryimage"},"image":{"@id":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild.png","datePublished":"2016-07-19T13:00:53+00:00","dateModified":"2026-03-17T06:59:28+00:00","description":"Following from my earlier article on elasticsearch-as-a-database, we will now take a look at the aggregation framework.","breadcrumb":{"@id":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#breadcrumb"},"inLanguage":"de","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/"]}]},{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#primaryimage","url":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild.png","contentUrl":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/07\/drastic-elastic-artikelbild.png","width":2300,"height":678,"caption":"Drastic Elastic Logo"},{"@type":"BreadcrumbList","@id":"https:\/\/www.inovex.de\/de\/blog\/drastic-elastic-part-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inovex.de\/de\/"},{"@type":"ListItem","position":2,"name":"Drastic Elastic [Part 2]: The aggregation framework"}]},{"@type":"WebSite","@id":"https:\/\/www.inovex.de\/de\/#website","url":"https:\/\/www.inovex.de\/de\/","name":"inovex GmbH","description":"","publisher":{"@id":"https:\/\/www.inovex.de\/de\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inovex.de\/de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"de"},{"@type":"Organization","@id":"https:\/\/www.inovex.de\/de\/#organization","name":"inovex GmbH","url":"https:\/\/www.inovex.de\/de\/","logo":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.inovex.de\/de\/#\/schema\/logo\/image\/","url":"https:\/\/www.inovex.de\/wp-content\/uploads\/2021\/03\/inovex-logo-16-9-1.png","contentUrl":"https:\/\/www.inovex.de\/wp-content\/uploads\/2021\/03\/inovex-logo-16-9-1.png","width":1921,"height":1081,"caption":"inovex GmbH"},"image":{"@id":"https:\/\/www.inovex.de\/de\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/inovexde","https:\/\/x.com\/inovexgmbh","https:\/\/www.instagram.com\/inovexlife\/","https:\/\/www.linkedin.com\/company\/inovex","https:\/\/www.youtube.com\/channel\/UC7r66GT14hROB_RQsQBAQUQ"]},{"@type":"Person","@id":"https:\/\/www.inovex.de\/de\/#\/schema\/person\/0519169c755e15b1478ccf638f16f06c","name":"Andrew Kenworthy","image":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.inovex.de\/de\/#\/schema\/person\/image\/7397755342ed757eeb6b1d51f16a4044","url":"https:\/\/secure.gravatar.com\/avatar\/c7a29df25f27010b3c581f97c66a52694571cfa2f9c9b79049542969194fbdd3?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c7a29df25f27010b3c581f97c66a52694571cfa2f9c9b79049542969194fbdd3?s=96&d=retro&r=g","caption":"Andrew Kenworthy"},"url":"https:\/\/www.inovex.de\/de\/blog\/author\/akenworthy\/"}]}},"_links":{"self":[{"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/posts\/1897","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/users\/49"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/comments?post=1897"}],"version-history":[{"count":2,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/posts\/1897\/revisions"}],"predecessor-version":[{"id":66518,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/posts\/1897\/revisions\/66518"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/media\/1892"}],"wp:attachment":[{"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/media?parent=1897"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/tags?post=1897"},{"taxonomy":"service","embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/service?post=1897"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/coauthors?post=1897"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}