Basic Aggregation Operations

Elasticsearch provides powerful aggregation capabilities for data analysis. Let's explore fundamental aggregation patetrns with practical examples.

Terms Aggregation with Null Value Handling

The following example demonstrates how to perform term-based aggregations while simultaneously counting documents with missing values in a specific field.

SearchRequest searchRequest = new SearchRequest("your_index");
SearchSourceBuilder sourceBuilder = new SearchSourceBuilder();
sourceBuilder.size(0);

TermsAggregationBuilder termsAgg = AggregationBuilders.terms("category_groups")
    .field("category_name")
    .size(1000);

MissingAggregationBuilder nullCount = AggregationBuilders.missing("missing_categories")
    .field("category_name");

sourceBuilder.aggregation(termsAgg);
sourceBuilder.aggregation(nullCount);

searchRequest.source(sourceBuilder);
SearchResponse response = client.search(searchRequest, RequestOptions.DEFAULT);

The corresponding JSON query would look like this:

{
  "size": 0,
  "aggregations": {
    "category_groups": {
      "terms": {
        "field": "category_name",
        "size": 1000,
        "order": [
          { "_count": "desc" },
          { "_key": "asc" }
        ]
      }
    },
    "missing_categories": {
      "missing": {
        "field": "category_name"
      }
    }
  }
}

Null Value Statsitics

To specifically count documents where a field contains null or missing values, use the Missing aggregation type:

MissingAggregationBuilder nullValueAgg = AggregationBuilders.missing("null_field_count")
    .field("important_field");

SearchSourceBuilder sourceBuilder = new SearchSourceBuilder();
sourceBuilder.size(0);
sourceBuilder.aggregation(nullValueAgg);

SearchRequest request = new SearchRequest("your_index");
request.source(sourceBuilder);
SearchResponse response = client.search(request, RequestOptions.DEFAULT);

The JSON represetnation:

{
  "size": 0,
  "aggregations": {
    "null_field_count": {
      "missing": {
        "field": "important_field"
      }
    }
  }
}

Advanced Aggregation with Sorting

Aggregations can be combined with sorting and additional sub-aggregations for complex analytical queries:

SearchSourceBuilder sourceBuilder = new SearchSourceBuilder();
sourceBuilder.size(0);

DateHistogramAggregationBuilder timeHistogram = AggregationBuilders.dateHistogram("time_buckets")
    .field("timestamp")
    .calendarInterval(DateHistogramInterval.MINUTE)
    .format("yyyy-MM-dd HH:mm")
    .order(BucketOrder.key(false));

AvgAggregationBuilder valueAvg = AggregationBuilders.avg("average_measurement")
    .field("measurement_value");

timeHistogram.subAggregation(valueAvg);

sourceBuilder.aggregation(timeHistogram);

SearchRequest request = new SearchRequest("sensor_data");
request.source(sourceBuilder);
SearchResponse response = client.search(request, RequestOptions.DEFAULT);

The resulting query structure:

{
  "size": 0,
  "aggs": {
    "time_buckets": {
      "date_histogram": {
        "field": "timestamp",
        "interval": "minute",
        "format": "yyyy-MM-dd HH:mm",
        "order": {
          "_key": "desc"
        }
      },
      "aggs": {
        "average_measurement": {
          "avg": {
            "field": "measurement_value"
          }
        }
      }
    }
  }
}