Sub aggregations in elasticsearch

Question

I am trying to work out with Elasticsearch aggregations! I want to fetch the users that have same operations ID anf for each ID also match two other fields! So it's like aggregations upon aggregations! I am not understanding how to go about it! Can someone help with structuring it??

Answer 1

From the official documentation:

Bucketing aggregations can have sub-aggregations (bucketing or metric). The sub-aggregations will be computed for the buckets which their parent aggregation generates. There is no hard limit on the level/depth of nested aggregations (one can nest an aggregation under a "parent" aggregation, which is itself a sub-aggregation of another higher-level aggregation).

You should also check out the more verbose Elasticsearch: The Definitive Guide.

There you can find complete examples, such as the following which is provided in the chapter "Aggregations » Aggregation Test-Drive » Adding a Metric to the Mix":

GET /cars/transactions/_search
{
   "size" : 0,
   "aggs": {
      "colors": {
         "terms": {
            "field": "color"
         },
         "aggs": { 
            "avg_price": { 
               "avg": {
                  "field": "price" 
               }
            }
         }
      }
   }
}

This aggregation is nesting the avg metric inside the terms bucket, effectively generating an average for each color (compare guide).