IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Top metrics aggregation Weighted avg aggregation »

› › ›

Value count aggregation

edit

Value count aggregation

edit

A single-value metrics aggregation that counts the number of values that are extracted from the aggregated documents. These values can be extracted either from specific fields in the documents, or be generated by a provided script. Typically, this aggregator will be used in conjunction with other single-value aggregations. For example, when computing the avg one might be interested in the number of values the average is computed over.

value_count does not de-duplicate values, so even if a field has duplicates (or a script generates multiple identical values for a single document), each value will be counted individually.

POST /sales/_search?size=0
{
  "aggs" : {
    "types_count" : { "value_count" : { "field" : "type" } }
  }
}

Response:

{
  ...
  "aggregations": {
    "types_count": {
      "value": 7
    }
  }
}

The name of the aggregation (types_count above) also serves as the key by which the aggregation result can be retrieved from the returned response.

Script

edit

Counting the values generated by a script:

POST /sales/_search?size=0
{
  "aggs": {
    "type_count": {
      "value_count": {
        "script": {
          "source": "doc['type'].value"
        }
      }
    }
  }
}

This will interpret the script parameter as an inline script with the painless script language and no script parameters. To use a stored script use the following syntax:

POST /sales/_search?size=0
{
  "aggs": {
    "types_count": {
      "value_count": {
        "script": {
          "id": "my_script",
          "params": {
            "field": "type"
          }
        }
      }
    }
  }
}

NOTE: Because value_count is designed to work with any field it internally treats all values as simple bytes. Due to this implementation, if _value script variable is used to fetch a value instead of accessing the field directly (e.g. a "value script"), the field value will be returned as a string instead of it’s native format.

Histogram fields

edit

When the value_count aggregation is computed on histogram fields, the result of the aggregation is the sum of all numbers in the counts array of the histogram.

For example, for the following index that stores pre-aggregated histograms with latency metrics for different networks:

PUT metrics_index/_doc/1
{
  "network.name" : "net-1",
  "latency_histo" : {
      "values" : [0.1, 0.2, 0.3, 0.4, 0.5],
      "counts" : [3, 7, 23, 12, 6] 
   }
}

PUT metrics_index/_doc/2
{
  "network.name" : "net-2",
  "latency_histo" : {
      "values" :  [0.1, 0.2, 0.3, 0.4, 0.5],
      "counts" : [8, 17, 8, 7, 6] 
   }
}

POST /metrics_index/_search?size=0
{
  "aggs": {
    "total_requests": {
      "value_count": { "field": "latency_histo" }
    }
  }
}

For each histogram field the value_count aggregation will sum all numbers in the counts array <1>. Eventually, it will add all values for all histograms and return the following result:

{
  ...
  "aggregations": {
    "total_requests": {
      "value": 97
    }
  }
}

« Top metrics aggregation Weighted avg aggregation »