Commit Graph

466 Commits

Author SHA1 Message Date
James Rodewig 693807a6d3
[DOCS] Fix double spaces (#71082) 2021-03-31 09:57:47 -04:00
Benjamin Trent c8415a7924
[ML] adding support for composite aggs in anomaly detection (#69970)
This commit allows for composite aggregations in datafeeds. 

Composite aggs provide a much better solution for having influencers, partitions, etc. on high volume data. Instead of worrying about long scrolls in the datafeed, the calculation is distributed across cluster via the aggregations. 

The restrictions for this support are as follows:

- The composite aggregation must have EXACTLY one `date_histogram` source
- The sub-aggs of the composite aggregation must have a `max` aggregation on the SAME timefield as the aforementioned `date_histogram` source
- The composite agg must be the ONLY top level agg and it cannot have a `composite` or `date_histogram` sub-agg
- If using a `date_histogram` to bucket time, it cannot have a `composite` sub-agg.
- The top-level `composite` agg cannot have a sibling pipeline agg. Pipeline aggregations are supported as a sub-agg (thus a pipeline agg INSIDE the bucket).

Some key user interaction differences:
- Speed + resources used by the cluster should be controlled by the `size` parameter in the `composite` aggregation. Previously, we said if you are using aggs, use a specific `chunking_config`. But, with composite, that is not necessary. 
- Users really shouldn't use nested `terms` aggs anylonger. While this is still a "valid" configuration and MAY be desirable for some users (only wanting the top 10 of certain terms), typically when users want influencers, partition fields, etc. they want the ENTIRE population. Previously, this really wasn't possible with aggs, with `composite` it is.
- I cannot really think of a typical usecase that SHOULD ever use a multi-bucket aggregation that is NOT supported by composite.
2021-03-30 08:25:40 -04:00
István Zoltán Szabó 9a8c6fb66f
[DOCS] Removes beta labels from DFA related docs. (#70808) 2021-03-26 09:46:41 +01:00
Nik Everett 2b9ed7d36f
Docs: Clean doc for agg parameter (#70675)
This adds a heading for `shard_min_doc_count` and merges the paragraphs
for them. I wanted to link to this section earlier today and it wasn't a
"real" section so I couldn't.

Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>
2021-03-24 16:22:26 -04:00
Ignacio Vera b81bb42ed9
Increase search.max_bucket by one (#70645) 2021-03-23 08:54:48 +01:00
James Rodewig 53574d2778
[DOCS] Reformat adjacency matrix agg reference (#70034) 2021-03-08 12:33:46 -05:00
James Rodewig 67288a1e4d [DOCS] Fix gap policy xref 2021-03-03 09:31:02 -05:00
James Rodewig e21cab640f
[DOCS] Reformat avg bucket agg reference (#69751) 2021-03-02 13:44:43 -05:00
Nik Everett ea131e5f5a
Docs: Switch terms agg scripting to runtime fields (#69628)
We expect runtime fields to perform a little better than our "native"
aggregation script so we should point folks to them instead of the
"native" aggregation script.
2021-03-02 11:27:21 -05:00
RomainGeffraye fe7afb9d36
[DOCS] Update example for `serial_diff` agg (#69635) 2021-03-01 08:37:29 -05:00
Lisa Cawley efa9b095aa
[DOCS] Adds model alias to inference processor and agg (#69576) 2021-02-24 13:12:39 -08:00
Igor Motov 7ad0201b25
Clarify the intended use case for multi_terms aggs (#69397)
This PR clarifies when multi_terms aggs should be used instead of composite
aggs or nested term aggs.

Relates to #65623
2021-02-23 15:11:53 -05:00
Nik Everett 1195b20a83
Docs: Add example fetching keyword in top_metrics (#69135)
Adds an example of fetching a keyword field.
2021-02-17 12:10:34 -05:00
James Rodewig 9b88ae92e6
[DOCS] Fix typos for duplicate words (#69125) 2021-02-17 10:34:20 -05:00
Dario Gieselaar a28e45c0c5
[DOCS] Remove keyword/ip from list of unsupported fields in top_metrics agg (#69036) 2021-02-17 08:41:57 -05:00
James Rodewig ab0f4d51b2
[DOCS] Add missing newline for bulleted list in top_metrics docs (#68481) (#68550)
Co-authored-by: Nathan L Smith <nathan.smith@elastic.co>
2021-02-04 14:49:02 -05:00
Igor Motov 9e3384ebc9
Add multi_terms aggs (#67597)
Adds a multi_terms aggregation support. The multi terms aggregation works
very similarly to the terms aggregation but supports multiple terms. The goal
of this PR is to add the basic functionality so it is not optimized at the
moment. It will be done in follow up PRs.

Closes #65623
2021-02-03 13:13:33 -05:00
James Rodewig 67f113314d
[DOCS] Fix acasting for agg types (#67469) 2021-01-13 14:44:54 -05:00
Adam Locke 82bfbe1195
[DOCS] Adding headers in TOC for aggregation docs. (#66604) 2020-12-18 11:31:42 -05:00
James Rodewig 77dc63b2de
[DOCS] Fix `search.max_buckets` default (#66311) 2020-12-14 21:55:27 -05:00
Nik Everett 524f39f61e
Drop experimental from variable width histogram (#66055)
Its been several months and we haven't bumped into any good reason to
rework the variable width histogram. So let's drop experimental from it!

Closes #58573
2020-12-08 14:15:21 -05:00
Mike Barretta 12c9ee4d80
Update inference-bucket-aggregation.asciidoc
tiny change to properly align the first code example and to add a missing word
2020-12-03 11:48:45 -05:00
James Rodewig e955f7752b
[DOCS] Fix typo in histogram agg docs (#65822) 2020-12-03 09:55:47 -05:00
Igor Motov a065b6d8da
Return an error when a rate aggregation cannot calculate bucket sizes (#65429)
In some cases when the rate aggregation is not a child of a date histogram
aggregation, it is not possible to determine the actual size of the date
histogram bucket. In this case the rate aggregation now throws an exception.

Closes #63703
2020-11-25 10:05:51 -05:00
Tal Levy a6755c3be8
Add mention of geo_shape support in geotile and geohash grid agg docs (#61129)
Previously, geo_shape support was only mentioned in a dedicated x-pack
section. This may be misleading, as the introductory paragraph only
mentions geo_point.

Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>
2020-11-24 13:57:42 -08:00
Tal Levy b514d9bf2e
Add geo_line aggregation (#41612)
A metric aggregation that aggregates a set of points as 
a GeoJSON LineString ordered by some sort parameter.

#### specifics

A `geo_line` aggregation request would specify a `geo_point` field, as well
as a `sort` field. `geo_point` represents the values used in the LineString, 
while the `sort` values will be used as the total ordering of the points.

the `sort` field would support any numeric field, including date.

#### sample usage

```
{
	"query": {
		"bool": {
			"must": [
				{ "term": { "person": "004" } },
				{ "term": { "trajectory": "20090131002206.plt" } }
			]
		}
	},
	"aggs": {
		"make_line": {
			"geo_line": {
				"point": {"field": "location"},
				"sort": { "field": "timestamp" },
                                "include_sort": true,
                                "sort_order": "desc",
                                "size": 15
			}
		}
	}
}
```

#### sample response

```
{
    "took": 21,
    "timed_out": false,
    "_shards": {...},
    "hits": {...},
    "aggregations": {
        "make_line": {
            "type": "LineString",
            "coordinates": [
                [
                    121.52926194481552,
                    38.92878997139633
                ],
                [
                    121.52922699227929,
                    38.92876998055726
                ],
             ]
        }
    }
}
```

#### visual response

<img width="540" alt="Screen Shot 2019-04-26 at 9 40 07 AM" src="https://user-images.githubusercontent.com/388837/56834977-cf278e00-6827-11e9-9c93-005ed48433cc.png">

#### limitations

Due to the cardinality of points, an initial max of 10k points 
will be used. This should support many use-cases.

One solution to overcome this limitation is to keep a PriorityQueue of
points, and simplifying the line once it hits this max. If simplifying
makes sense, it may be a nice option, in general. The ability to use a parameter
to specify how aggressive one wants to simplify. This parameter could be 
the number of points. Example algorithm one could use with a PriorityQueue:
https://bost.ocks.org/mike/simplify/. This would still require O(m) space, where m
is the number of points returned. And would also require heapifying triangles
sorted by their areas, which would be O(log(m)) operations. Since sorting is done, 
anyways, simplifying would still be a O(n log(m)) operation, where n is the total number 
of points to filter........... something to explore


closes #41649
2020-11-23 10:26:27 -08:00
Wylie Conlon 10ee0f2878
Clarify field data cache behavior in docs (#64375)
* Clarify that field data cache includes global ordinals
* Describe that the cache should be cleared once the limit is reached
* Clarify that the `_id` field does not supported aggregations anymore
* Fold the `fielddata` mapping parameter page into the `text field docs
* Improve cross-linking
2020-11-20 13:53:23 -08:00
Adam Locke 9fdcd79927
Explicitly defining types for sources parameter (#65006) 2020-11-12 16:09:04 -05:00
Mark Tozzi f666ccb3bc
Add supports for upper and lower values on boxplot based on the IQR value (#63617) 2020-11-04 14:39:05 -05:00
James Rodewig 8bc922512c
[DOCS] Redirect moving avg aggregation (#64435) 2020-10-30 14:12:09 -04:00
James Rodewig 2e9f95aa73
[DOCS] Change agg titles to sentence case (#64425) 2020-10-30 13:25:21 -04:00
James Rodewig 37b6adaf91
[DOCS] Rewrite aggs overview (#64318)
- Replaces more abstract docs about object structure and values source with task-based examples.
- Relocates several sections from the current `misc.asciidoc` file.
- Alphabetically sorts agg categories in the nav.
- Removes the matrix agg family. Moves the stats matrix agg under the metric agg family

Co-authored-by: debadair <debadair@elastic.co>
2020-10-30 08:39:38 -04:00
István Zoltán Szabó 6093518f4a
[DOCS] Changes experimental flag to beta in DFA related docs (#63992) 2020-10-26 17:02:46 +01:00
Hugo Chargois ff736f078b
Allow mixing set-based and regexp-based include and exclude (#63325)
* Allow mixing set-based and regexp-based include and exclude

* Coding style

* Disallow having both set and regexp include (resp. exclude)

* Test correctness of every combination of include/exclude
2020-10-21 10:26:42 -04:00
Aref Razavi 245663e5b7 Remove useless parentheses in bucket_key formula (#63868) 2020-10-19 11:54:21 +02:00
Igor Motov e6c70f6811
Add value_count mode to rate agg (#63687)
Adds a new value count mode to the rate aggregation.

Closes #63575
2020-10-15 18:00:44 -04:00
Igor Motov 34bff3f776
Add support for histogram fields to rate aggregation (#63289)
The rate aggregation now supports histogram fields. At the moment only sum
is supported. 

Closes #62939
2020-10-08 16:54:25 -04:00
Przemyslaw Gomulka b38eaae47f
[doc] Rounding range query rules (#63109)
a documentation explaining defaulting of missing fields when using date math parser.
relates #62268
2020-10-02 08:59:27 +02:00
Benjamin Trent 1084aaf18a
[ML] renames */inference* apis to */trained_models* (#63097)
This commit renames all `inference` CRUD APIs to `trained_models`.

This aligns with internal terminology, documentation, and use-cases.
2020-10-01 12:13:49 -04:00
Lisa Cawley ecf9e929ba
[DOCS] Add experimental tag to inference processor and bucket aggregation (#63023) 2020-09-30 07:20:38 -07:00
James Rodewig 277709004e
[DOCS] Fix elasticsearch-croneval chunking (#63008) 2020-09-29 09:53:20 -04:00
Christos Soulios b857768bb5
Histogram field type support for min/max aggregations (#62532)
Implement min/max aggregations for histogram fields.

Closes #60951
2020-09-19 23:34:43 +03:00
Julie Tibshirani f29c743a47
Support the 'fields' option in inner_hits and top_hits. (#62259)
This PR adds support for the 'fields' option in the following places:
* Anytime `inner_hits` is used, for both fetching nested/ child docs and field collapsing
* The `top_hits` aggregation

Addresses #61949.
2020-09-14 10:08:58 -07:00
Igor Motov f107dba741
Add rate aggregation (#61369)
Adds a new rate aggregation that can calculate a document rate for buckets
of a date_histogram.

Closes #60674
2020-08-25 11:32:20 -04:00
István Zoltán Szabó 8da6bba0fc
[DOCS] Adds example to the inference aggregation description (#61290) 2020-08-19 11:20:42 +02:00
Nik Everett cebd5d47e2
Redo experimental tag on vwh (#61065)
The docs didn't have the standard experimental text. This adds it.
2020-08-18 10:00:54 -04:00
James Rodewig 456c37b186
[DOCS] Add usage tips to `top_hits` agg (#61215) 2020-08-17 12:42:04 -04:00
Adam Locke fdc867e395
[DOCS] Update info about geo_shape bounding boxes (#61214)
* Adding information about geo_shape bounding boxes.

* Fixing cross link and incorporating review feedback.
2020-08-17 11:07:18 -04:00
James Rodewig a94e5cb7c4
[DOCS] Replace Wikipedia links with attribute (#61171) 2020-08-17 09:44:24 -04:00
Gilad Gal 8534bd5ce7
Update normalize-aggregation.asciidoc
The second method normalizes linearly between 0..100
2020-08-12 22:24:36 +03:00