What is the most suitable datatype to use in aggregations with ElasticSearch 5: numeric or keyword?

Question

In a Elasticsearch index, I have a few fields which are referencing main categories' ids (e.g. sector_id, country_id, etc...).

These fields are solely use for filtering (using the term/terms filters) and for creating buckets in terms aggregations (among others).

Each one of them is currently using the smallest suitable numeric datatype (e.g. byte, short, etc..)

Is this the best datatype to be used on these for heavy aggregations?

Or should these be using the keyword datatype?

Thanks in advance for any advice!

Answer 1

If the values of those fields are numeric, you should go for a numeric type, if they are strings, then go for the keyword type.

One thing to bear in mind is that if you want to run range queries and/or range aggregations on those fields at some point, you should prefer using a numeric type up front so that those values can be sorted numerically and not lexically.

For instance: if you have country ids such as 1, 2, 3, ..., 10, 11, 12, ..., 20, ... and they are mapped as keyword (i.e. string) then if you run a range query (or aggregation) on them with from: 1, to: 3, you'll also get 11, 12, 13, etc since in the string world, 11 is lexically smaller than 3.