Value Count Aggregation

A single-value metrics aggregation that counts the number of values that are extracted from the aggregated documents. These values can be extracted either from specific fields in the documents, or be generated by a provided script. Typically, this aggregator will be used in conjunction with other single-value aggregations. For example, when computing the avg one might be interested in the number of values the average is computed over.

value_count does not de-duplicate values, so even if a field has duplicates (or a script generates multiple identical values for a single document), each value will be counted individually.

  1. POST /sales/_search?size=0
  2. {
  3.   "aggs" : {
  4.     "types_count" : { "value_count" : { "field" : "type" } }
  5.   }
  6. }

Response:

  1. {
  2.   ...
  3.   "aggregations": {
  4.     "types_count": {
  5.       "value": 7
  6.     }
  7.   }
  8. }

The name of the aggregation (types_count above) also serves as the key by which the aggregation result can be retrieved from the returned response.

Script

Counting the values generated by a script:

  1. POST /sales/_search?size=0
  2. {
  3.   "aggs": {
  4.     "type_count": {
  5.       "value_count": {
  6.         "script": {
  7.           "source": "doc['type'].value"
  8.         }
  9.       }
  10.     }
  11.   }
  12. }

This will interpret the script parameter as an inline script with the painless script language and no script parameters. To use a stored script use the following syntax:

  1. POST /sales/_search?size=0
  2. {
  3.   "aggs": {
  4.     "types_count": {
  5.       "value_count": {
  6.         "script": {
  7.           "id": "my_script",
  8.           "params": {
  9.             "field": "type"
  10.           }
  11.         }
  12.       }
  13.     }
  14.   }
  15. }

NOTE

Because value_count is designed to work with any field it internally treats all values as simple bytes. Due to this implementation, if _value script variable is used to fetch a value instead of accessing the field directly (e.g. a “value script”), the field value will be returned as a string instead of it’s native format.

Histogram fields

When the value_count aggregation is computed on histogram fields, the result of the aggregation is the sum of all numbers in the counts array of the histogram.

For example, for the following index that stores pre-aggregated histograms with latency metrics for different networks:

  1. PUT metrics_index/_doc/1
  2. {
  3.   "network.name" : "net-1",
  4.   "latency_histo" : {
  5.       "values" : [0.1, 0.2, 0.3, 0.4, 0.5],
  6.       "counts" : [3, 7, 23, 12, 6] 
  7.    }
  8. }
  10. PUT metrics_index/_doc/2
  11. {
  12.   "network.name" : "net-2",
  13.   "latency_histo" : {
  14.       "values" :  [0.1, 0.2, 0.3, 0.4, 0.5],
  15.       "counts" : [8, 17, 8, 7, 6] 
  16.    }
  17. }
  19. POST /metrics_index/_search?size=0
  20. {
  21.   "aggs": {
  22.     "total_requests": {
  23.       "value_count": { "field": "latency_histo" }
  24.     }
  25.   }
  26. }

For each histogram field the value_count aggregation will sum all numbers in the counts array <1>. Eventually, it will add all values for all histograms and return the following result:

  1. {
  2.   ...
  3.   "aggregations": {
  4.     "total_requests": {
  5.       "value": 97
  6.     }
  7.   }
  8. }