# Single-value metrics aggregations

**URL:** <https://discuss.elastic.co/t/single-value-metrics-aggregations/181638>\
**Category:** Elasticsearch\
**Created:** [May 17, 2019, 7:00pm UTC](https://discuss.elastic.co/t/single-value-metrics-aggregations/181638 "2019-05-17T19:00:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cecoke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cecoke/32/55308_2.png) [@cecoke](https://discuss.elastic.co/u/cecoke)\
**Post date:** [May 17, 2019, 7:00pm UTC](https://discuss.elastic.co/t/single-value-metrics-aggregations/181638/1 "2019-05-17T19:00:30Z")

</div>

Hi Elastic,

I want to learn how Elasticsearch does the simplest single-value metrics aggregation (count, sum, avg, max, min) on large data. Does each shard aggregate first and the final node aggregates the shard-level aggregates? Or each shard sends all matched documents to one node and the node does aggregation? If there is link to the code, I can also read that. Thank you!

---

<div class="post-metadata">

**Author:** ![cecoke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cecoke/32/55308_2.png) [@cecoke](https://discuss.elastic.co/u/cecoke)\
**Post date:** [May 17, 2019, 7:02pm UTC](https://discuss.elastic.co/t/single-value-metrics-aggregations/181638/2 "2019-05-17T19:02:50Z")

</div>

Here is an example query.

```auto
{
    'aggs' : {
        'ok_rate' : {
            'avg' : {
                'script' : {
                    'source' : 'doc.status.value == 200 ? 1 : 0'
                }
            }
        }
    },
    'query': {
        'bool' : {
            'filter' : [{
                'range' : {
                    '@timestamp' : {
                        'gte' : time,
                        'lte' : time,
                        'format' : 'epoch_second'
                    }
                }
            }]
        }
    },
    "size" : 0
}

```

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [May 20, 2019, 4:25pm UTC](https://discuss.elastic.co/t/single-value-metrics-aggregations/181638/3 "2019-05-20T16:25:09Z")

</div>

Hi cecoke,

> [@cecoke](#):
>
> Or each shard sends all matched documents to one node

No, that's not a scalable approach. Each shard returns interim aggregation state which is [merged](https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/search/aggregations/InternalAggregations.java#L99) by a coordinating node to produce the final result. Example interim state for average is here: [https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/search/aggregations/metrics/InternalAvg.java#L90](https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/search/aggregations/metrics/InternalAvg.java#L90)

---

<div class="post-metadata">

**Author:** ![cecoke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cecoke/32/55308_2.png) [@cecoke](https://discuss.elastic.co/u/cecoke)\
**Post date:** [May 20, 2019, 4:30pm UTC](https://discuss.elastic.co/t/single-value-metrics-aggregations/181638/4 "2019-05-20T16:30:03Z")

</div>

> [@Mark\_Harwood](#):
>
> Each shard returns interim aggregation state which is [merged](https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/search/aggregations/InternalAggregations.java#L99) by a coordinating node to produce the final result. Example in

Thank you so much for your help, Mark!

Closing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2019, 4:30pm UTC](https://discuss.elastic.co/t/single-value-metrics-aggregations/181638/5 "2019-06-17T16:30:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.