[Recipes] Range and Data Range Aggregations

Problem:

Demonstrate the use of range and date range aggregarions.

Solution Summary:

We can use "range" for normal ranges and "date_range" for date ranges. "from" and "to" specifies the start and end for a bucket. While "from" is included in result, "to" is not included. Also, data_range can use standard date math we saw earlier.

Prerequisites:

Set up accounts index from accounts.json as explained in the link. Make sure you add opening_date field as given in the link.

Solution Steps:

Case 1 - Range Aggregation

GET accounts/_search
{
"aggs": {
"age_distribution": {
"range": {
"field": "age",
"ranges": [
{
"to": 30
},
{
"from": 30,
"to": 40
},
{
"from": 40
}
]
}
}
},
"size": 0
}

Response contains:

"aggregations": {
"age_distribution": {
"buckets": [
{
"key": "*-30.0",
"to": 30,
"doc_count": 451
},
{
"key": "30.0-40.0",
"from": 30,
"to": 40,
"doc_count": 504
},
{
"key": "40.0-*",
"from": 40,
"doc_count": 45
}
]
}
}

Case 2 - Date Range Aggregation

GET accounts/_search
{
"aggs": {
"opening_date_distribution": {
"date_range": {
"field": "opening_date",
"ranges": [
{
"to": "2018/01/01"
},
{
"from": "2018/01/01",
"to": "now"
},
{
"from": "now"
}
]
}
}
},
"size": 0
}

Note:

In real world, opening_date will not be in future.
Optional format parameter can be used along with "field" to specify a different date format:
1. "field": "opening_date",
  "format": "yyyy/mm/dd",
  ...

Case 3 - Date Range with Custom Key Names

GET accounts/_search
{
"aggs": {
"opening_date_distribution": {
"date_range": {
"field": "opening_date",
"ranges": [
{
"to": "2018/01/01",
"key": "past"
},
{
"from": "2018/01/01",
"to": "now",
"key": "current"
},
{
"from": "now",
"key": "future"
}
]
}
}
},
"size": 0
}

Response contains:

"aggregations": {
"opening_date_distribution": {
"buckets": [
{
"key": "past",
"to": 1514764800000,
"to_as_string": "2018/01/01 00:00:00",
"doc_count": 0
},
{
"key": "current",
"from": 1514764800000,
"from_as_string": "2018/01/01 00:00:00",
"to": 1526656189468,
"to_as_string": "2018/05/18 15:09:49",
"doc_count": 8
},
{
"key": "future",
"from": 1526656189468,
"from_as_string": "2018/05/18 15:09:49",
"doc_count": 2
}
]
}
}

Case 4 - Date Range with Array of Named Objects

Just add "keyed": true alongside "field":

GET accounts/_search
{
"aggs": {
"opening_date_distribution": {
"date_range": {
"field": "opening_date",
"keyed": true,
"ranges": [
{
"to": "2018/01/01",
"key": "past"
},
{
"from": "2018/01/01",
"to": "now",
"key": "current"
},
{
"from": "now",
"key": "future"
}
]
}
}
},
"size": 0
}

Response contains:

"aggregations": {
"opening_date_distribution": {
"buckets": {
"past": {
"to": 1514764800000,
"to_as_string": "2018/01/01 00:00:00",
"doc_count": 0
},
"current": {

...

TODO