---
type: api
title: Aggregation
url: https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-aggregations-aggregationcontainer
resource: https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-aggregations-aggregationcontainer
products:
  - Elasticsearch
---

# Aggregation

`map string to Aggregation`

This type represents a dictionary mapping string keys to `Aggregation` values.

## Properties

- `aggregations` (map string to Aggregation) — recursive
  Sub-aggregations for this aggregation.
Only applies to bucket aggregations.
- `meta` (object)
- `adjacency_matrix` (object)
  A bucket aggregation returning a form of adjacency matrix.
The request provides a collection of named filter expressions, similar to the `filters` aggregation.
Each bucket in the response represents a non-empty cell in the matrix of intersecting filters.
  - `filters` (map string to {} Query)
    Filters used to create buckets.
At least one filter is required.
    See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)
  - `separator` (string)
    Separator used to concatenate filter names. Defaults to &.
- `auto_date_histogram` (object)
  A multi-bucket aggregation similar to the date histogram, except instead of providing an interval to use as the width of each bucket, a target number of buckets is provided.
  - `buckets` (number · default: 10)
    The target number of buckets.
  - `field` (string)
    The field on which to run the aggregation.
  - `format` (string)
    The date format used to format `key_as_string` in the response.
If no `format` is specified, the first date format specified in the field mapping is used.
  - `minimum_interval` (union enum | string) — nullable
    The minimum rounding interval.
This can make the collection process more efficient, as the aggregation will not attempt to round at any interval lower than `minimum_interval`.
    Values: `second`, `minute`, `hour`, `day`, `month`, `year`
  - `missing` (union oneOf)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
    One of: `string` or `number`
  - `offset` (string)
    Time zone specified as a ISO 8601 UTC offset.
  - `params` (map string to object)
  - `script` (string)
  - `time_zone` (string)
    Time zone ID.
- `avg` (object)
  A single-value metrics aggregation that computes the average of numeric values that are extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
- `avg_bucket` (object)
  A sibling pipeline aggregation which calculates the mean value of a specified metric in a sibling aggregation.
The specified metric must be numeric and the sibling aggregation must be a multi-bucket aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
- `boxplot` (object)
  A metrics aggregation that computes a box plot of numeric values extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `compression` (number)
    Limits the maximum number of nodes used by the underlying TDigest algorithm to `20 * compression`, enabling control of memory usage and approximation error.
  - `execution_hint` (enum · default: default)
    The default implementation of TDigest is optimized for performance, scaling to millions or even billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error for millions of samples in some cases).
To use an implementation optimized for accuracy, set this parameter to high_accuracy instead.
    Values: `default`, `high_accuracy`
- `bucket_script` (object)
  A parent pipeline aggregation which runs a script which can perform per bucket computations on metrics in the parent multi-bucket aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
  - `script` (string)
    The script to run for this aggregation.
- `bucket_selector` (object)
  A parent pipeline aggregation which runs a script to determine whether the current bucket will be retained in the parent multi-bucket aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
  - `script` (string)
    The script to run for this aggregation.
- `bucket_sort` (object)
  A parent pipeline aggregation which sorts the buckets of its parent multi-bucket aggregation.
  - `from` (number)
    Buckets in positions prior to `from` will be truncated.
  - `gap_policy` (enum · default: skip)
    The policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
  - `size` (number)
    The number of buckets to return.
Defaults to all buckets of the parent aggregation.
  - `sort` (union oneOf)
    The list of fields to sort on.
    A value or an array; each item is one of:
    - **string**
      Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    - **SortOptions**
      - `_score` (object)
        - `order` (enum)
          

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
          Values: `asc`, `desc`
      - `_doc` (object)
        - `order` (enum)
          

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
          Values: `asc`, `desc`
      - `_geo_distance` (object)
        - `mode` (enum)
          Values: `min`, `max`, `sum`, `avg`, `median`
        - `distance_type` (enum)
          

Supported values include:
  - `arc`: The `arc` calculation is the most accurate.
  - `plane`: The `plane` calculation is faster but less accurate.
          Values: `arc`, `plane`
        - `ignore_unmapped` (boolean)
        - `order` (enum)
          

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
          Values: `asc`, `desc`
        - `unit` (enum)
          Values: `in`, `ft`, `yd`, `mi`, `nmi`, `km`, `m`, `cm`, `mm`
        - `nested` (object)
          - `filter` ({} Query)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)
          - `max_children` (number)
          - `nested` (object) — recursive
            Same fields as `nested` in `_geo_distance`
          - `path` (string)
      - `_script` (object)
        - `order` (enum)
          

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
          Values: `asc`, `desc`
        - `script` (string)
        - `type` (enum)
          Values: `string`, `number`, `version`
        - `mode` (enum)
          Values: `min`, `max`, `sum`, `avg`, `median`
        - `nested` (object)
          - `filter` ({} Query)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)
          - `max_children` (number)
          - `nested` (object) — recursive
            Same fields as `nested` in `_script`
          - `path` (string)
- `bucket_count_ks_test` (object)
  A sibling pipeline aggregation which runs a two sample Kolmogorov–Smirnov test ("K-S test") against a provided distribution and the distribution implied by the documents counts in the configured sibling aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `alternative` (string[])
    A list of string values indicating which K-S test alternative to calculate. The valid values
are: "greater", "less", "two_sided". This parameter is key for determining the K-S statistic used
when calculating the K-S test. Default value is all possible alternative hypotheses.
  - `fractions` (number[])
    A list of doubles indicating the distribution of the samples with which to compare to the `buckets_path` results.
In typical usage this is the overall proportion of documents in each bucket, which is compared with the actual
document proportions in each bucket from the sibling aggregation counts. The default is to assume that overall
documents are uniformly distributed on these buckets, which they would be if one used equal percentiles of a
metric to define the bucket end points.
  - `sampling_method` (string)
    Indicates the sampling methodology when calculating the K-S test. Note, this is sampling of the returned values.
This determines the cumulative distribution function (CDF) points used comparing the two samples. Default is
`upper_tail`, which emphasizes the upper end of the CDF points. Valid options are: `upper_tail`, `uniform`,
and `lower_tail`.
- `bucket_correlation` (object)
  A sibling pipeline aggregation which runs a correlation function on the configured sibling multi-bucket aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `function` (object)
    The correlation function to execute.
    - `count_correlation` (object)
      The configuration to calculate a count correlation. This function is designed for determining the correlation of a term value and a given metric.
      - `indicator` (object)
        The indicator with which to correlate the configured `bucket_path` values.
        - `doc_count` (number)
          The total number of documents that initially created the expectations. It’s required to be greater
than or equal to the sum of all values in the buckets_path as this is the originating superset of data
to which the term values are correlated.
        - `expectations` (number[])
          An array of numbers with which to correlate the configured `bucket_path` values.
The length of this value must always equal the number of buckets returned by the `bucket_path`.
        - `fractions` (number[])
          An array of fractions to use when averaging and calculating variance. This should be used if
the pre-calculated data and the buckets_path have known gaps. The length of fractions, if provided,
must equal expectations.
- `cardinality` (object)
  A single-value metrics aggregation that calculates an approximate count of distinct values.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `precision_threshold` (number · default: 3000)
    A unique count below which counts are expected to be close to accurate.
This allows to trade memory for accuracy.
  - `rehash` (boolean)
  - `execution_hint` (enum)
    Mechanism by which cardinality aggregations is run.

Supported values include:
  - `global_ordinals`: Run the aggregation by using global ordinals of the field and resolving those values after finishing a shard.
  - `segment_ordinals`: Run the aggregation by using segment ordinal values and resolving those values after each segment.
  - `direct`: Run the aggregation by using field values directly.
  - `save_memory_heuristic`: Heuristic-based mode, default in Elasticsearch 8.3 and earlier.
  - `save_time_heuristic`: Heuristic-based mode, default in Elasticsearch 8.4 and later.
    Values: `global_ordinals`, `segment_ordinals`, `direct`, `save_memory_heuristic`, `save_time_heuristic`
- `cartesian_bounds` (object)
  A metric aggregation that computes the spatial bounding box containing all values for a Point or Shape field.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
- `cartesian_centroid` (object)
  A metric aggregation that computes the weighted centroid from all coordinate values for point and shape fields.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
- `categorize_text` (object)
  A multi-bucket aggregation that groups semi-structured text into buckets.
  - `field` (string)
    The semi-structured text field to categorize.
  - `max_unique_tokens` (number · default: 50)
    The maximum number of unique tokens at any position up to max_matched_tokens. Must be larger than 1.
Smaller values use less memory and create fewer categories. Larger values will use more memory and
create narrower categories. Max allowed value is 100.
  - `max_matched_tokens` (number · default: 5)
    The maximum number of token positions to match on before attempting to merge categories. Larger
values will use more memory and create narrower categories. Max allowed value is 100.
  - `similarity_threshold` (number · default: 50)
    The minimum percentage of tokens that must match for text to be added to the category bucket. Must
be between 1 and 100. The larger the value the narrower the categories. Larger values will increase memory
usage and create narrower categories.
  - `categorization_filters` (string[])
    This property expects an array of regular expressions. The expressions are used to filter out matching
sequences from the categorization field values. You can use this functionality to fine tune the categorization
by excluding sequences from consideration when categories are defined. For example, you can exclude SQL
statements that appear in your log files. This property cannot be used at the same time as categorization_analyzer.
If you only want to define simple regular expression filters that are applied prior to tokenization, setting
this property is the easiest method. If you also want to customize the tokenizer or post-tokenization filtering,
use the categorization_analyzer property instead and include the filters as pattern_replace character filters.
  - `categorization_analyzer` (union oneOf)
    The categorization analyzer specifies how the text is analyzed and tokenized before being categorized.
The syntax is very similar to that used to define the analyzer in the analyze API. This property
cannot be used at the same time as `categorization_filters`.
    - **string**
    - **CustomCategorizeTextAnalyzer**
      - `char_filter` (string[])
      - `tokenizer` (string)
      - `filter` (string[])
  - `shard_size` (number)
    The number of categorization buckets to return from each shard before merging all the results.
  - `size` (number · default: 10)
    The number of buckets to return.
  - `min_doc_count` (number)
    The minimum number of documents in a bucket to be returned to the results.
  - `shard_min_doc_count` (number)
    The minimum number of documents in a bucket to be returned from the shard before merging.
- `change_point` (object)
  A sibling pipeline that detects, spikes, dips, and change points in a metric.
Given a distribution of values provided by the sibling multi-bucket aggregation,
this aggregation indicates the bucket of any spike or dip and/or the bucket at which
the largest change in the distribution of values, if they are statistically significant.
There must be at least 22 bucketed values. Fewer than 1,000 is preferred.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
- `children` (object)
  A single bucket aggregation that selects child documents that have the specified type, as defined in a `join` field.
  - `type` (string)
    The child type that should be selected.
- `composite` (object)
  A multi-bucket aggregation that creates composite buckets from different sources.
Unlike the other multi-bucket aggregations, you can use the `composite` aggregation to paginate *all* buckets from a multi-level aggregation efficiently.
  - `after` (object)
    When paginating, use the `after_key` value returned in the previous response to retrieve the next page.
  - `size` (number · default: 10)
    The number of composite buckets that should be returned.
  - `sources` (string to object[])
    The value sources used to build composite buckets.
Keys are returned in the order of the `sources` definition.
- `cumulative_cardinality` (object)
  A parent pipeline aggregation which calculates the cumulative cardinality in a parent `histogram` or `date_histogram` aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
- `cumulative_sum` (object)
  A parent pipeline aggregation which calculates the cumulative sum of a specified metric in a parent `histogram` or `date_histogram` aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
- `date_histogram` (object)
  A multi-bucket values source based aggregation that can be applied on date values or date range values extracted from the documents.
It dynamically builds fixed size (interval) buckets over the values.
  - `calendar_interval` (enum)
    Calendar-aware interval.
Can be specified using the unit name, such as `month`, or as a single unit quantity, such as `1M`.
    Values: `second`, `1s`, `minute`, `1m`, `hour`, `1h`, `day`, `1d`, `week`, `1w`, `month`, `1M`, `quarter`, `1q`, `year`, `1y`
  - `extended_bounds` (object)
    Enables extending the bounds of the histogram beyond the data itself.
    - `max` (union oneOf)
      Maximum value for the bound.
      One of: `string` or `number`
    - `min` (union oneOf)
      Minimum value for the bound.
      One of: `string` or `number`
  - `hard_bounds` (object)
    Limits the histogram to specified bounds.
    - `max` (union oneOf)
      Maximum value for the bound.
      One of: `string` or `number`
    - `min` (union oneOf)
      Minimum value for the bound.
      One of: `string` or `number`
  - `field` (string)
    The date field whose values are use to build a histogram.
  - `fixed_interval` (string)
    Fixed intervals: a fixed number of SI units and never deviate, regardless of where they fall on the calendar.
  - `format` (string)
    The date format used to format `key_as_string` in the response.
If no `format` is specified, the first date format specified in the field mapping is used.
  - `interval` (string)
  - `min_doc_count` (number)
    Only returns buckets that have `min_doc_count` number of documents.
By default, all buckets between the first bucket that matches documents and the last one are returned.
  - `missing` (union oneOf)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
    One of: `string` or `number`
  - `offset` (string)
    Changes the start value of each bucket by the specified positive (`+`) or negative offset (`-`) duration.
  - `order` (union oneOf)
    The sort order of the returned buckets.
    One of: `string to enum[]` or `string to enum`
  - `params` (map string to object)
  - `script` (string)
  - `time_zone` (string)
    Time zone used for bucketing and rounding.
Defaults to Coordinated Universal Time (UTC).
  - `keyed` (boolean)
    Set to `true` to associate a unique string key with each bucket and return the ranges as a hash rather than an array.
- `date_range` (object)
  A multi-bucket value source based aggregation that enables the user to define a set of date ranges - each representing a bucket.
  - `field` (string)
    The date field whose values are use to build ranges.
  - `format` (string)
    The date format used to format `from` and `to` in the response.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `ranges` (object[])
    Array of date ranges.
    - `from` (union oneOf)
      Start of the range (inclusive).
      One of: `string` or `number`
    - `key` (string)
      Custom key to return the range with.
    - `to` (union oneOf)
      End of the range (exclusive).
      One of: `string` or `number`
  - `time_zone` (string)
    Time zone used to convert dates from another time zone to UTC.
  - `keyed` (boolean)
    Set to `true` to associate a unique string key with each bucket and returns the ranges as a hash rather than an array.
- `derivative` (object)
  A parent pipeline aggregation which calculates the derivative of a specified metric in a parent `histogram` or `date_histogram` aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
- `diversified_sampler` (object)
  A filtering aggregation used to limit any sub aggregations' processing to a sample of the top-scoring documents.
Similar to the `sampler` aggregation, but adds the ability to limit the number of matches that share a common value.
  - `execution_hint` (enum · default: global_ordinals)
    The type of value used for de-duplication.

Supported values include:
  - `map`: Hold field values directly.
  - `global_ordinals`: Hold ordinals of the field as determined by the Lucene index.
  - `bytes_hash`: Hold hashes of the field values - with potential for hash collisions.
    Values: `map`, `global_ordinals`, `bytes_hash`
  - `max_docs_per_value` (number · default: 1)
    Limits how many documents are permitted per choice of de-duplicating value.
  - `script` (string)
  - `shard_size` (number · default: 100)
    Limits how many top-scoring documents are collected in the sample processed on each shard.
  - `field` (string)
    The field used to provide values used for de-duplication.
- `extended_stats` (object)
  A multi-value metrics aggregation that computes stats over numeric values extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
  - `sigma` (number)
    The number of standard deviations above/below the mean to display.
- `extended_stats_bucket` (object)
  A sibling pipeline aggregation which calculates a variety of stats across all bucket of a specified metric in a sibling aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
  - `sigma` (number)
    The number of standard deviations above/below the mean to display.
- `frequent_item_sets` (object)
  A bucket aggregation which finds frequent item sets, a form of association rules mining that identifies items that often occur together.
  - `fields` (object[])
    Fields to analyze.
    - `field` (string)
    - `exclude` (union oneOf)
      Values to exclude.
Can be regular expression strings or arrays of strings of exact terms.
      One of: `string[]` or `string`
    - `include` (union oneOf)
      Values to include.
Can be regular expression strings or arrays of strings of exact terms.
      - **[]string**
      - **string**
      - **TermsPartition**
        - `num_partitions` (number)
          The number of partitions.
        - `partition` (number)
          The partition number for this request.
  - `minimum_set_size` (number · default: 1)
    The minimum size of one item set.
  - `minimum_support` (number · default: 0.1)
    The minimum support of one item set.
  - `size` (number · default: 10)
    The number of top item sets to return.
  - `filter` ({} Query)
    Query that filters documents from analysis.
    See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)
- `filter` ({} Query)
  A single bucket aggregation that narrows the set of documents to those that match a query.
  See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)
- `filters` (object)
  A multi-bucket aggregation where each bucket contains the documents that match a query.
  - `filters` (union oneOf)
    Collection of queries from which to build buckets.
    - **[string to Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)**
    - **[][Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)**
      An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
  - `other_bucket` (boolean)
    Set to `true` to add a bucket to the response which will contain all documents that do not match any of the given filters.
  - `other_bucket_key` (string · default: _other_)
    The key with which the other bucket is returned.
  - `keyed` (boolean · default: true)
    By default, the named filters aggregation returns the buckets as an object.
Set to `false` to return the buckets as an array of objects.
- `geo_bounds` (object)
  A metric aggregation that computes the geographic bounding box containing all values for a Geopoint or Geoshape field.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `wrap_longitude` (boolean · default: true)
    Specifies whether the bounding box should be allowed to overlap the international date line.
- `geo_centroid` (object)
  A metric aggregation that computes the weighted centroid from all coordinate values for geo fields.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `count` (number)
  - `location` (union oneOf)
    - **LatLonGeoLocation**
      - `lat` (number)
        Latitude
      - `lon` (number)
        Longitude
    - **GeoHashLocation**
      - `geohash` (string)
    - **[]number**
    - **string**
- `geo_distance` (object)
  A multi-bucket aggregation that works on `geo_point` fields.
Evaluates the distance of each document value from an origin point and determines the buckets it belongs to, based on ranges defined in the request.
  - `distance_type` (enum · default: arc)
    The distance calculation type.

Supported values include:
  - `arc`: The `arc` calculation is the most accurate.
  - `plane`: The `plane` calculation is faster but less accurate.
    Values: `arc`, `plane`
  - `field` (string)
    A field of type `geo_point` used to evaluate the distance.
  - `origin` (union oneOf)
    The origin  used to evaluate the distance.
    - **LatLonGeoLocation**
      - `lat` (number)
        Latitude
      - `lon` (number)
        Longitude
    - **GeoHashLocation**
      - `geohash` (string)
    - **[]number**
    - **string**
  - `ranges` (object[])
    An array of ranges used to bucket documents.
    - `from` (union number | string) — nullable
      Start of the range (inclusive).
    - `key` (string)
      Custom key to return the range with.
    - `to` (union number | string) — nullable
      End of the range (exclusive).
  - `unit` (enum · default: m)
    The distance unit.
    Values: `in`, `ft`, `yd`, `mi`, `nmi`, `km`, `m`, `cm`, `mm`
- `geohash_grid` (object)
  A multi-bucket aggregation that groups `geo_point` and `geo_shape` values into buckets that represent a grid.
Each cell is labeled using a geohash which is of user-definable precision.
  - `bounds` (union oneOf)
    The bounding box to filter the points in each bucket.
    - **CoordsGeoBounds**
      - `top` (number)
      - `bottom` (number)
      - `left` (number)
      - `right` (number)
    - **TopLeftBottomRightGeoBounds**
      - `top_left` (union oneOf)
        - **LatLonGeoLocation**
          - `lat` (number)
            Latitude
          - `lon` (number)
            Longitude
        - **GeoHashLocation**
          - `geohash` (string)
        - **[]number**
        - **string**
      - `bottom_right` (union oneOf)
        - **LatLonGeoLocation**
          - `lat` (number)
            Latitude
          - `lon` (number)
            Longitude
        - **GeoHashLocation**
          - `geohash` (string)
        - **[]number**
        - **string**
    - **TopRightBottomLeftGeoBounds**
      - `top_right` (union oneOf)
        - **LatLonGeoLocation**
          - `lat` (number)
            Latitude
          - `lon` (number)
            Longitude
        - **GeoHashLocation**
          - `geohash` (string)
        - **[]number**
        - **string**
      - `bottom_left` (union oneOf)
        - **LatLonGeoLocation**
          - `lat` (number)
            Latitude
          - `lon` (number)
            Longitude
        - **GeoHashLocation**
          - `geohash` (string)
        - **[]number**
        - **string**
    - **WktGeoBounds**
      - `wkt` (string)
  - `field` (string)
    Field containing indexed `geo_point` or `geo_shape` values.
If the field contains an array, `geohash_grid` aggregates all array values.
  - `precision` (number | string · default: 5)
    The string length of the geohashes used to define cells/buckets in the results.
  - `shard_size` (number)
    Allows for more accurate counting of the top cells returned in the final result the aggregation.
Defaults to returning `max(10,(size x number-of-shards))` buckets from each shard.
  - `size` (number · default: 10000)
    The maximum number of geohash buckets to return.
- `geo_line` (object)
  Aggregates all `geo_point` values within a bucket into a `LineString` ordered by the chosen sort field.
  - `point` (object)
    The name of the geo_point field.
    - `field` (string)
      The name of the geo_point field.
  - `sort` (object)
    The name of the numeric field to use as the sort key for ordering the points.
When the `geo_line` aggregation is nested inside a `time_series` aggregation, this field defaults to `@timestamp`, and any other value will result in error.
    - `field` (string)
      The name of the numeric field to use as the sort key for ordering the points.
  - `include_sort` (boolean)
    When `true`, returns an additional array of the sort values in the feature properties.
  - `sort_order` (enum · default: asc)
    The order in which the line is sorted (ascending or descending).

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
    Values: `asc`, `desc`
  - `size` (number · default: 10000)
    The maximum length of the line represented in the aggregation.
Valid sizes are between 1 and 10000.
- `geotile_grid` (object)
  A multi-bucket aggregation that groups `geo_point` and `geo_shape` values into buckets that represent a grid.
Each cell corresponds to a map tile as used by many online map sites.
  - `field` (string)
    Field containing indexed `geo_point` or `geo_shape` values.
If the field contains an array, `geotile_grid` aggregates all array values.
  - `precision` (number · default: 7)
    Integer zoom of the key used to define cells/buckets in the results.
Values outside of the range [0,29] will be rejected.
  - `shard_size` (number)
    Allows for more accurate counting of the top cells returned in the final result the aggregation.
Defaults to returning `max(10,(size x number-of-shards))` buckets from each shard.
  - `size` (number · default: 10000)
    The maximum number of buckets to return.
  - `bounds` (union oneOf)
    A bounding box to filter the geo-points or geo-shapes in each bucket.
    Same options as `bounds` in `geohash_grid`
- `geohex_grid` (object)
  A multi-bucket aggregation that groups `geo_point` and `geo_shape` values into buckets that represent a grid.
Each cell corresponds to a H3 cell index and is labeled using the H3Index representation.
  - `field` (string)
    Field containing indexed `geo_point` or `geo_shape` values.
If the field contains an array, `geohex_grid` aggregates all array values.
  - `precision` (number · default: 6)
    Integer zoom of the key used to defined cells or buckets
in the results. Value should be between 0-15.
  - `bounds` (union oneOf)
    Bounding box used to filter the geo-points in each bucket.
    Same options as `bounds` in `geohash_grid`
  - `size` (number · default: 10000)
    Maximum number of buckets to return.
  - `shard_size` (number)
    Number of buckets returned from each shard.
- `global` (object)
  Defines a single bucket of all the documents within the search execution context.
This context is defined by the indices and the document types you’re searching on, but is not influenced by the search query itself.
- `histogram` (object)
  A multi-bucket values source based aggregation that can be applied on numeric values or numeric range values extracted from the documents.
It dynamically builds fixed size (interval) buckets over the values.
  - `extended_bounds` (object)
    Enables extending the bounds of the histogram beyond the data itself.
    - `max` (number)
      Maximum value for the bound.
    - `min` (number)
      Minimum value for the bound.
  - `hard_bounds` (object)
    Limits the range of buckets in the histogram.
It is particularly useful in the case of open data ranges that can result in a very large number of buckets.
    - `max` (number)
      Maximum value for the bound.
    - `min` (number)
      Minimum value for the bound.
  - `field` (string)
    The name of the field to aggregate on.
  - `interval` (number)
    The interval for the buckets.
Must be a positive decimal.
  - `min_doc_count` (number)
    Only returns buckets that have `min_doc_count` number of documents.
By default, the response will fill gaps in the histogram with empty buckets.
  - `missing` (number)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `offset` (number)
    By default, the bucket keys start with 0 and then continue in even spaced steps of `interval`.
The bucket boundaries can be shifted by using the `offset` option.
  - `order` (union oneOf)
    The sort order of the returned buckets.
By default, the returned buckets are sorted by their key ascending.
    One of: `string to enum[]` or `string to enum`
  - `script` (string)
  - `format` (string)
  - `keyed` (boolean · default: false)
    If `true`, returns buckets as a hash instead of an array, keyed by the bucket keys.
- `ip_range` (object)
  A multi-bucket value source based aggregation that enables the user to define a set of IP ranges - each representing a bucket.
  - `field` (string)
    The date field whose values are used to build ranges.
  - `ranges` (object[])
    Array of IP ranges.
    - `from` (union string) — nullable
      Start of the range.
      One of: `string`
    - `mask` (string)
      IP range defined as a CIDR mask.
    - `to` (union string) — nullable
      End of the range.
      One of: `string`
- `ip_prefix` (object)
  A bucket aggregation that groups documents based on the network or sub-network of an IP address.
  - `field` (string)
    The IP address field to aggregation on. The field mapping type must be `ip`.
  - `prefix_length` (number)
    Length of the network prefix. For IPv4 addresses the accepted range is [0, 32].
For IPv6 addresses the accepted range is [0, 128].
  - `is_ipv6` (boolean · default: false)
    Defines whether the prefix applies to IPv6 addresses.
  - `append_prefix_length` (boolean · default: false)
    Defines whether the prefix length is appended to IP address keys in the response.
  - `keyed` (boolean)
    Defines whether buckets are returned as a hash rather than an array in the response.
  - `min_doc_count` (number · default: 1)
    Minimum number of documents in a bucket for it to be included in the response.
- `inference` (object)
  A parent pipeline aggregation which loads a pre-trained model and performs inference on the collated result fields from the parent bucket aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
  - `model_id` (string)
    The ID or alias for the trained model.
  - `inference_config` (object)
    Contains the inference type and its options.
    - `regression` (object)
      Regression configuration for inference.
      - `results_field` (string)
        The field that is added to incoming documents to contain the inference prediction. Defaults to predicted_value.
      - `num_top_feature_importance_values` (number · default: 0)
        Specifies the maximum number of feature importance values per document.
    - `classification` (object)
      Classification configuration for inference.
      - `num_top_classes` (number)
        Specifies the number of top class predictions to return. Defaults to 0.
      - `num_top_feature_importance_values` (number · default: 0)
        Specifies the maximum number of feature importance values per document.
      - `prediction_field_type` (string)
        Specifies the type of the predicted field to write. Acceptable values are: string, number, boolean. When boolean is provided 1.0 is transformed to true and 0.0 to false.
      - `results_field` (string)
        The field that is added to incoming documents to contain the inference prediction. Defaults to predicted_value.
      - `top_classes_results_field` (string)
        Specifies the field to which the top classes are written. Defaults to top_classes.
- `line` (object)
  - `point` (object)
    The name of the geo_point field.
    - `field` (string)
      The name of the geo_point field.
  - `sort` (object)
    The name of the numeric field to use as the sort key for ordering the points.
When the `geo_line` aggregation is nested inside a `time_series` aggregation, this field defaults to `@timestamp`, and any other value will result in error.
    - `field` (string)
      The name of the numeric field to use as the sort key for ordering the points.
  - `include_sort` (boolean)
    When `true`, returns an additional array of the sort values in the feature properties.
  - `sort_order` (enum · default: asc)
    The order in which the line is sorted (ascending or descending).

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
    Values: `asc`, `desc`
  - `size` (number · default: 10000)
    The maximum length of the line represented in the aggregation.
Valid sizes are between 1 and 10000.
- `matrix_stats` (object)
  A numeric aggregation that computes the following statistics over a set of document fields: `count`, `mean`, `variance`, `skewness`, `kurtosis`, `covariance`, and `covariance`.
  - `fields` (union oneOf)
    An array of fields for computing the statistics.
    One of: `string[]` or `string`
  - `missing` (map string to number)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `mode` (enum · default: avg)
    Array value the aggregation will use for array or multi-valued fields.
    Values: `min`, `max`, `sum`, `avg`, `median`
- `max` (object)
  A single-value metrics aggregation that returns the maximum value among the numeric values extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
- `max_bucket` (object)
  A sibling pipeline aggregation which identifies the bucket(s) with the maximum value of a specified metric in a sibling aggregation and outputs both the value and the key(s) of the bucket(s).
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
- `median_absolute_deviation` (object)
  A single-value aggregation that approximates the median absolute deviation of its search results.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
  - `compression` (number · default: 1000)
    Limits the maximum number of nodes used by the underlying TDigest algorithm to `20 * compression`, enabling control of memory usage and approximation error.
  - `execution_hint` (enum · default: default)
    The default implementation of TDigest is optimized for performance, scaling to millions or even billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error for millions of samples in some cases).
To use an implementation optimized for accuracy, set this parameter to high_accuracy instead.
    Values: `default`, `high_accuracy`
- `min` (object)
  A single-value metrics aggregation that returns the minimum value among numeric values extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
- `min_bucket` (object)
  A sibling pipeline aggregation which identifies the bucket(s) with the minimum value of a specified metric in a sibling aggregation and outputs both the value and the key(s) of the bucket(s).
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
- `missing` (object)
  A field data based single bucket aggregation, that creates a bucket of all documents in the current document set context that are missing a field value (effectively, missing a field or having the configured NULL value set).
  - `field` (string)
    The name of the field.
  - `missing` (boolean | number | string)
- `moving_avg` (union oneOf)
  - **model: linear** (`model: linear`)
    - `model` (enum)
      Values: `linear`
    - `buckets_path` (union oneOf)
      Path to the buckets that contain one set of values to correlate.
      One of: `string[]` or `string` or `string to string`
    - `format` (string)
      `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
    - `gap_policy` (enum · default: skip)
      Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
      Values: `skip`, `insert_zeros`, `keep_values`
    - `minimize` (boolean)
    - `predict` (number)
    - `window` (number)
    - `settings` (object)
  - **model: simple** (`model: simple`)
    - `model` (enum)
      Values: `simple`
    - `buckets_path` (union oneOf)
      Path to the buckets that contain one set of values to correlate.
      One of: `string[]` or `string` or `string to string`
    - `format` (string)
      `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
    - `gap_policy` (enum · default: skip)
      Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
      Values: `skip`, `insert_zeros`, `keep_values`
    - `minimize` (boolean)
    - `predict` (number)
    - `window` (number)
    - `settings` (object)
  - **model: ewma** (`model: ewma`)
    - `model` (enum)
      Values: `ewma`
    - `buckets_path` (union oneOf)
      Path to the buckets that contain one set of values to correlate.
      One of: `string[]` or `string` or `string to string`
    - `format` (string)
      `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
    - `gap_policy` (enum · default: skip)
      Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
      Values: `skip`, `insert_zeros`, `keep_values`
    - `minimize` (boolean)
    - `predict` (number)
    - `window` (number)
    - `settings` (object)
      - `alpha` (number)
  - **model: holt** (`model: holt`)
    - `model` (enum)
      Values: `holt`
    - `buckets_path` (union oneOf)
      Path to the buckets that contain one set of values to correlate.
      One of: `string[]` or `string` or `string to string`
    - `format` (string)
      `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
    - `gap_policy` (enum · default: skip)
      Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
      Values: `skip`, `insert_zeros`, `keep_values`
    - `minimize` (boolean)
    - `predict` (number)
    - `window` (number)
    - `settings` (object)
      - `alpha` (number)
      - `beta` (number)
  - **model: holt_winters** (`model: holt_winters`)
    - `model` (enum)
      Values: `holt_winters`
    - `buckets_path` (union oneOf)
      Path to the buckets that contain one set of values to correlate.
      One of: `string[]` or `string` or `string to string`
    - `format` (string)
      `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
    - `gap_policy` (enum · default: skip)
      Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
      Values: `skip`, `insert_zeros`, `keep_values`
    - `minimize` (boolean)
    - `predict` (number)
    - `window` (number)
    - `settings` (object)
      - `alpha` (number)
      - `beta` (number)
      - `gamma` (number)
      - `pad` (boolean)
      - `period` (number)
      - `type` (enum)
        Values: `add`, `mult`
- `moving_percentiles` (object)
  Given an ordered series of percentiles, "slides" a window across those percentiles and computes cumulative percentiles.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
  - `window` (number)
    The size of window to "slide" across the histogram.
  - `shift` (number · default: 0)
    By default, the window consists of the last n values excluding the current bucket.
Increasing `shift` by 1, moves the starting window position by 1 to the right.
  - `keyed` (boolean)
- `moving_fn` (object)
  Given an ordered series of data, "slides" a window across the data and runs a custom script on each window of data.
For convenience, a number of common functions are predefined such as `min`, `max`, and moving averages.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
  - `script` (string)
    The script that should be executed on each window of data.
  - `shift` (number · default: 0)
    By default, the window consists of the last n values excluding the current bucket.
Increasing `shift` by 1, moves the starting window position by 1 to the right.
  - `window` (number)
    The size of window to "slide" across the histogram.
- `multi_terms` (object)
  A multi-bucket value source based aggregation where buckets are dynamically built - one per unique set of values.
  - `collect_mode` (enum · default: breadth_first)
    Specifies the strategy for data collection.

Supported values include:
  - `depth_first`: Expands all branches of the aggregation tree in one depth-first pass, before any pruning occurs.
  - `breadth_first`: Caches the set of documents that fall into the uppermost buckets for subsequent replay.
    Values: `depth_first`, `breadth_first`
  - `order` (union oneOf)
    Specifies the sort order of the buckets.
Defaults to sorting by descending document count.
    One of: `string to enum[]` or `string to enum`
  - `min_doc_count` (number · default: 1)
    The minimum number of documents in a bucket for it to be returned.
  - `shard_min_doc_count` (number · default: 1)
    The minimum number of documents in a bucket on each shard for it to be returned.
  - `shard_size` (number)
    The number of candidate terms produced by each shard.
By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.
  - `show_term_doc_count_error` (boolean · default: false)
    Calculates the doc count error on per term basis.
  - `size` (number · default: 10)
    The number of term buckets should be returned out of the overall terms list.
  - `terms` (object[])
    The field from which to generate sets of terms.
    - `missing` (boolean | number | string)
      The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
    - `field` (string)
      A field from which to retrieve terms.
It is required if `script` is not provided.
    - `script` (string)
      A script to calculate terms to aggregate on.
It is required if `field` is not provided.
- `nested` (object)
  A special single bucket aggregation that enables aggregating nested documents.
  - `path` (string)
    The path to the field of type `nested`.
- `normalize` (object)
  A parent pipeline aggregation which calculates the specific normalized/rescaled value for a specific bucket value.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
  - `method` (enum)
    The specific method to apply.

Supported values include:
  - `rescale_0_1`: This method rescales the data such that the minimum number is 0, and the maximum number is 1, with the rest normalized linearly in-between.
  - `rescale_0_100`: This method rescales the data such that the minimum number is 0, and the maximum number is 100, with the rest normalized linearly in-between.
  - `percent_of_sum`: This method normalizes each value so that it represents a percentage of the total sum it attributes to.
  - `mean`: This method normalizes such that each value is normalized by how much it differs from the average.
  - `z-score`: This method normalizes such that each value represents how far it is from the mean relative to the standard deviation.
  - `softmax`: This method normalizes such that each value is exponentiated and relative to the sum of the exponents of the original values.
    Values: `rescale_0_1`, `rescale_0_100`, `percent_of_sum`, `mean`, `z-score`, `softmax`
- `parent` (object)
  A special single bucket aggregation that selects parent documents that have the specified type, as defined in a `join` field.
  - `type` (string)
    The child type that should be selected.
- `percentile_ranks` (object)
  A multi-value metrics aggregation that calculates one or more percentile ranks over numeric values extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
  - `keyed` (boolean · default: true)
    By default, the aggregation associates a unique string key with each bucket and returns the ranges as a hash rather than an array.
Set to `false` to disable this behavior.
  - `values` (union number[] | string) — nullable
    An array of values for which to calculate the percentile ranks.
  - `hdr` (object)
    Uses the alternative High Dynamic Range Histogram algorithm to calculate percentile ranks.
    - `number_of_significant_value_digits` (number)
      Specifies the resolution of values for the histogram in number of significant digits.
  - `tdigest` (object)
    Sets parameters for the default TDigest algorithm used to calculate percentile ranks.
    - `compression` (number)
      Limits the maximum number of nodes used by the underlying TDigest algorithm to `20 * compression`, enabling control of memory usage and approximation error.
    - `execution_hint` (enum · default: default)
      The default implementation of TDigest is optimized for performance, scaling to millions or even billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error for millions of samples in some cases).
To use an implementation optimized for accuracy, set this parameter to high_accuracy instead.
      Values: `default`, `high_accuracy`
- `percentiles` (object)
  A multi-value metrics aggregation that calculates one or more percentiles over numeric values extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
  - `keyed` (boolean · default: true)
    By default, the aggregation associates a unique string key with each bucket and returns the ranges as a hash rather than an array.
Set to `false` to disable this behavior.
  - `percents` (union number | number[])
    The percentiles to calculate.
  - `hdr` (object)
    Uses the alternative High Dynamic Range Histogram algorithm to calculate percentiles.
    - `number_of_significant_value_digits` (number)
      Specifies the resolution of values for the histogram in number of significant digits.
  - `tdigest` (object)
    Sets parameters for the default TDigest algorithm used to calculate percentiles.
    - `compression` (number)
      Limits the maximum number of nodes used by the underlying TDigest algorithm to `20 * compression`, enabling control of memory usage and approximation error.
    - `execution_hint` (enum · default: default)
      The default implementation of TDigest is optimized for performance, scaling to millions or even billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error for millions of samples in some cases).
To use an implementation optimized for accuracy, set this parameter to high_accuracy instead.
      Values: `default`, `high_accuracy`
- `percentiles_bucket` (object)
  A sibling pipeline aggregation which calculates percentiles across all bucket of a specified metric in a sibling aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
  - `percents` (number[])
    The list of percentiles to calculate.
- `range` (object)
  A multi-bucket value source based aggregation that enables the user to define a set of ranges - each representing a bucket.
  - `field` (string)
    The date field whose values are use to build ranges.
  - `missing` (number)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `ranges` (object[])
    An array of ranges used to bucket documents.
    - `from` (union number | string) — nullable
      Start of the range (inclusive).
    - `key` (string)
      Custom key to return the range with.
    - `to` (union number | string) — nullable
      End of the range (exclusive).
  - `script` (string)
  - `keyed` (boolean)
    Set to `true` to associate a unique string key with each bucket and return the ranges as a hash rather than an array.
  - `format` (string)
- `rare_terms` (object)
  A multi-bucket value source based aggregation which finds "rare" terms — terms that are at the long-tail of the distribution and are not frequent.
  - `exclude` (union oneOf)
    Terms that should be excluded from the aggregation.
    One of: `string[]` or `string`
  - `field` (string)
    The field from which to return rare terms.
  - `include` (union oneOf)
    Terms that should be included in the aggregation.
    - **[]string**
    - **string**
    - **TermsPartition**
      - `num_partitions` (number)
        The number of partitions.
      - `partition` (number)
        The partition number for this request.
  - `max_doc_count` (number · default: 1)
    The maximum number of documents a term should appear in.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `precision` (number · default: 0.001)
    The precision of the internal CuckooFilters.
Smaller precision leads to better approximation, but higher memory usage.
  - `value_type` (string)
- `rate` (object)
  Calculates a rate of documents or a field in each bucket.
Can only be used inside a `date_histogram` or `composite` aggregation.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
  - `unit` (enum)
    The interval used to calculate the rate.
By default, the interval of the `date_histogram` is used.
    Values: `second`, `1s`, `minute`, `1m`, `hour`, `1h`, `day`, `1d`, `week`, `1w`, `month`, `1M`, `quarter`, `1q`, `year`, `1y`
  - `mode` (enum · default: sum)
    How the rate is calculated.

Supported values include:
  - `sum`: Calculates the sum of all values of the field.
  - `value_count`: Uses the number of values of the field.
    Values: `sum`, `value_count`
- `reverse_nested` (object)
  A special single bucket aggregation that enables aggregating on parent documents from nested documents.
Should only be defined inside a `nested` aggregation.
  - `path` (string)
    Defines the nested object field that should be joined back to.
The default is empty, which means that it joins back to the root/main document level.
- `random_sampler` (object)
  A single bucket aggregation that randomly includes documents in the aggregated results.
Sampling provides significant speed improvement at the cost of accuracy.
  - `probability` (number)
    The probability that a document will be included in the aggregated data.
Must be greater than 0, less than 0.5, or exactly 1.
The lower the probability, the fewer documents are matched.
  - `seed` (number)
    The seed to generate the random sampling of documents.
When a seed is provided, the random subset of documents is the same between calls.
  - `shard_seed` (number)
    When combined with seed, setting shard_seed ensures 100% consistent sampling over shards where data is exactly the same.
- `sampler` (object)
  A filtering aggregation used to limit any sub aggregations' processing to a sample of the top-scoring documents.
  - `shard_size` (number · default: 100)
    Limits how many top-scoring documents are collected in the sample processed on each shard.
- `scripted_metric` (object)
  A metric aggregation that uses scripts to provide a metric output.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `combine_script` (string)
    Runs once on each shard after document collection is complete.
Allows the aggregation to consolidate the state returned from each shard.
  - `init_script` (string)
    Runs prior to any collection of documents.
Allows the aggregation to set up any initial state.
  - `map_script` (string)
    Run once per document collected.
If no `combine_script` is specified, the resulting state needs to be stored in the `state` object.
  - `params` (map string to object)
    A global object with script parameters for `init`, `map` and `combine` scripts.
It is shared between the scripts.
  - `reduce_script` (string)
    Runs once on the coordinating node after all shards have returned their results.
The script is provided with access to a variable `states`, which is an array of the result of the `combine_script` on each shard.
- `serial_diff` (object)
  An aggregation that subtracts values in a time series from themselves at different time lags or periods.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
  - `lag` (number)
    The historical bucket to subtract from the current value.
Must be a positive, non-zero integer.
- `significant_terms` (object)
  Returns interesting or unusual occurrences of terms in a set.
  - `background_filter` ({} Query)
    A background filter that can be used to focus in on significant terms within a narrower context, instead of the entire index.
    See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)
  - `chi_square` (object)
    Use Chi square, as described in "Information Retrieval", Manning et al., Chapter 13.5.2, as the significance score.
    - `background_is_superset` (boolean)
      Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to.
    - `include_negatives` (boolean)
      Set to `false` to filter out the terms that appear less often in the subset than in documents outside the subset.
  - `exclude` (union oneOf)
    Terms to exclude.
    One of: `string[]` or `string`
  - `execution_hint` (enum)
    Mechanism by which the aggregation should be executed: using field values directly or using global ordinals.
    Values: `map`, `global_ordinals`, `global_ordinals_hash`, `global_ordinals_low_cardinality`
  - `field` (string)
    The field from which to return significant terms.
  - `gnd` (object)
    Use Google normalized distance as described in "The Google Similarity Distance", Cilibrasi and Vitanyi, 2007, as the significance score.
    - `background_is_superset` (boolean)
      Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to.
  - `include` (union oneOf)
    Terms to include.
    - **[]string**
    - **string**
    - **TermsPartition**
      - `num_partitions` (number)
        The number of partitions.
      - `partition` (number)
        The partition number for this request.
  - `jlh` (object)
    Use JLH score as the significance score.
  - `min_doc_count` (number · default: 3)
    Only return terms that are found in more than `min_doc_count` hits.
  - `mutual_information` (object)
    Use mutual information as described in "Information Retrieval", Manning et al., Chapter 13.5.1, as the significance score.
    - `background_is_superset` (boolean)
      Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to.
    - `include_negatives` (boolean)
      Set to `false` to filter out the terms that appear less often in the subset than in documents outside the subset.
  - `percentage` (object)
    A simple calculation of the number of documents in the foreground sample with a term divided by the number of documents in the background with the term.
  - `script_heuristic` (object)
    Customized score, implemented via a script.
    - `script` (string)
  - `p_value` (object)
    Significant terms heuristic that calculates the p-value between the term existing in foreground and background sets.

The p-value is the probability of obtaining test results at least as extreme as
the results actually observed, under the assumption that the null hypothesis is
correct. The p-value is calculated assuming that the foreground set and the
background set are independent https://en.wikipedia.org/wiki/Bernoulli_trial, with the null
hypothesis that the probabilities are the same.
    - `background_is_superset` (boolean)
    - `normalize_above` (number · default: 0)
      Should the results be normalized when above the given value.
Allows for consistent significance results at various scales.
Note: `0` is a special value which means no normalization
  - `shard_min_doc_count` (number)
    Regulates the certainty a shard has if the term should actually be added to the candidate list or not with respect to the `min_doc_count`.
Terms will only be considered if their local shard frequency within the set is higher than the `shard_min_doc_count`.
  - `shard_size` (number)
    Can be used to control the volumes of candidate terms produced by each shard.
By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.
  - `size` (number)
    The number of buckets returned out of the overall terms list.
- `significant_text` (object)
  Returns interesting or unusual occurrences of free-text terms in a set.
  - `background_filter` ({} Query)
    A background filter that can be used to focus in on significant terms within a narrower context, instead of the entire index.
    See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)
  - `chi_square` (object)
    Use Chi square, as described in "Information Retrieval", Manning et al., Chapter 13.5.2, as the significance score.
    - `background_is_superset` (boolean)
      Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to.
    - `include_negatives` (boolean)
      Set to `false` to filter out the terms that appear less often in the subset than in documents outside the subset.
  - `exclude` (union oneOf)
    Values to exclude.
    One of: `string[]` or `string`
  - `execution_hint` (enum)
    Determines whether the aggregation will use field values directly or global ordinals.
    Values: `map`, `global_ordinals`, `global_ordinals_hash`, `global_ordinals_low_cardinality`
  - `field` (string)
    The field from which to return significant text.
  - `filter_duplicate_text` (boolean)
    Whether to out duplicate text to deal with noisy data.
  - `gnd` (object)
    Use Google normalized distance as described in "The Google Similarity Distance", Cilibrasi and Vitanyi, 2007, as the significance score.
    - `background_is_superset` (boolean)
      Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to.
  - `include` (union oneOf)
    Values to include.
    - **[]string**
    - **string**
    - **TermsPartition**
      - `num_partitions` (number)
        The number of partitions.
      - `partition` (number)
        The partition number for this request.
  - `jlh` (object)
    Use JLH score as the significance score.
  - `min_doc_count` (number · default: 3)
    Only return values that are found in more than `min_doc_count` hits.
  - `mutual_information` (object)
    Use mutual information as described in "Information Retrieval", Manning et al., Chapter 13.5.1, as the significance score.
    - `background_is_superset` (boolean)
      Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to.
    - `include_negatives` (boolean)
      Set to `false` to filter out the terms that appear less often in the subset than in documents outside the subset.
  - `percentage` (object)
    A simple calculation of the number of documents in the foreground sample with a term divided by the number of documents in the background with the term.
  - `script_heuristic` (object)
    Customized score, implemented via a script.
    - `script` (string)
  - `shard_min_doc_count` (number)
    Regulates the certainty a shard has if the values should actually be added to the candidate list or not with respect to the min_doc_count.
Values will only be considered if their local shard frequency within the set is higher than the `shard_min_doc_count`.
  - `shard_size` (number)
    The number of candidate terms produced by each shard.
By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.
  - `size` (number)
    The number of buckets returned out of the overall terms list.
  - `source_fields` (union oneOf)
    Overrides the JSON `_source` fields from which text will be analyzed.
    One of: `string[]` or `string`
- `stats` (object)
  A multi-value metrics aggregation that computes stats over numeric values extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
- `stats_bucket` (object)
  A sibling pipeline aggregation which calculates a variety of stats across all bucket of a specified metric in a sibling aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
- `string_stats` (object)
  A multi-value metrics aggregation that computes statistics over string values extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `show_distribution` (boolean · default: false)
    Shows the probability distribution for all characters.
- `sum` (object)
  A single-value metrics aggregation that sums numeric values that are extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
- `sum_bucket` (object)
  A sibling pipeline aggregation which calculates the sum of a specified metric across all buckets in a sibling aggregation.
  - `buckets_path` (union oneOf)
    Path to the buckets that contain one set of values to correlate.
    One of: `string[]` or `string` or `string to string`
  - `format` (string)
    `DecimalFormat` pattern for the output value.
If specified, the formatted value is returned in the aggregation’s `value_as_string` property.
  - `gap_policy` (enum · default: skip)
    Policy to apply when gaps are found in the data.

Supported values include:
  - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and
continue calculating using the next available value.
  - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.
  - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,
otherwise the empty bucket is skipped.
    Values: `skip`, `insert_zeros`, `keep_values`
- `terms` (object)
  A multi-bucket value source based aggregation where buckets are dynamically built - one per unique value.
  - `collect_mode` (enum)
    Determines how child aggregations should be calculated: breadth-first or depth-first.

Supported values include:
  - `depth_first`: Expands all branches of the aggregation tree in one depth-first pass, before any pruning occurs.
  - `breadth_first`: Caches the set of documents that fall into the uppermost buckets for subsequent replay.
    Values: `depth_first`, `breadth_first`
  - `exclude` (union oneOf)
    Values to exclude.
Accepts regular expressions and partitions.
    One of: `string[]` or `string`
  - `execution_hint` (enum)
    Determines whether the aggregation will use field values directly or global ordinals.
    Values: `map`, `global_ordinals`, `global_ordinals_hash`, `global_ordinals_low_cardinality`
  - `field` (string)
    The field from which to return terms.
  - `include` (union oneOf)
    Values to include.
Accepts regular expressions and partitions.
    - **[]string**
    - **string**
    - **TermsPartition**
      - `num_partitions` (number)
        The number of partitions.
      - `partition` (number)
        The partition number for this request.
  - `min_doc_count` (number · default: 1)
    Only return values that are found in more than `min_doc_count` hits.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `missing_order` (enum)
    Values: `first`, `last`, `default`
  - `missing_bucket` (boolean)
  - `value_type` (string)
    Coerced unmapped fields into the specified type.
  - `order` (union oneOf)
    Specifies the sort order of the buckets.
Defaults to sorting by descending document count.
    One of: `string to enum[]` or `string to enum`
  - `script` (string)
  - `shard_min_doc_count` (number)
    Regulates the certainty a shard has if the term should actually be added to the candidate list or not with respect to the `min_doc_count`.
Terms will only be considered if their local shard frequency within the set is higher than the `shard_min_doc_count`.
  - `shard_size` (number)
    The number of candidate terms produced by each shard.
By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.
  - `show_term_doc_count_error` (boolean)
    Set to `true` to return the `doc_count_error_upper_bound`, which is an upper bound to the error on the `doc_count` returned by each shard.
  - `size` (number · default: 10)
    The number of buckets returned out of the overall terms list.
  - `format` (string)
- `time_series` (object)
  The time series aggregation queries data created using a time series index.
This is typically data such as metrics or other data streams with a time component, and requires creating an index using the time series mode.
  - `size` (number · default: 10000)
    The maximum number of results to return.
  - `keyed` (boolean)
    Set to `true` to associate a unique string key with each bucket and returns the ranges as a hash rather than an array.
- `top_hits` (object)
  A metric aggregation that returns the top matching documents per bucket.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `docvalue_fields` (object[])
    Fields for which to return doc values.
    - `field` (string)
      A wildcard pattern. The request returns values for field names matching this pattern.
    - `format` (string)
      The format in which the values are returned.
    - `include_unmapped` (boolean)
  - `explain` (boolean · default: false)
    If `true`, returns detailed information about score computation as part of a hit.
  - `fields` (object[])
    Array of wildcard (*) patterns. The request returns values for field names
matching these patterns in the hits.fields property of the response.
    - `field` (string)
      A wildcard pattern. The request returns values for field names matching this pattern.
    - `format` (string)
      The format in which the values are returned.
    - `include_unmapped` (boolean)
  - `from` (number · default: 0)
    Starting document offset.
  - `highlight` (object)
    Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in the search results.
    - `type` (union anyOf)
      

Supported values include:
  - `plain`: The `plain` highlighter uses the standard Lucene highlighter
  - `fvh`: The fvh highlighter uses the Lucene Fast Vector highlighter.
  - `unified`: The unified highlighter uses the Lucene Unified Highlighter.
      Values: `plain`, `fvh`, `unified`
    - `boundary_chars` (string · default: .,!? \t\n)
      A string that contains each boundary character.
    - `boundary_max_scan` (number · default: 20)
      How far to scan for boundary characters.
    - `boundary_scanner` (enum)
      Specifies how to break the highlighted fragments: chars, sentence, or word.
Only valid for the unified and fvh highlighters.
Defaults to `sentence` for the `unified` highlighter. Defaults to `chars` for the `fvh` highlighter.

Supported values include:
  - `chars`: Use the characters specified by `boundary_chars` as highlighting boundaries.
The `boundary_max_scan` setting controls how far to scan for boundary characters.
Only valid for the `fvh` highlighter.
  - `sentence`: Break highlighted fragments at the next sentence boundary, as determined by Java’s `BreakIterator`.
You can specify the locale to use with `boundary_scanner_locale`.
When used with the `unified` highlighter, the `sentence` scanner splits sentences bigger than `fragment_size` at the first word boundary next to fragment_size.
You can set `fragment_size` to `0` to never split any sentence.
  - `word`: Break highlighted fragments at the next word boundary, as determined by Java’s `BreakIterator`.
You can specify the locale to use with `boundary_scanner_locale`.
      Values: `chars`, `sentence`, `word`
    - `boundary_scanner_locale` (string · default: Locale.ROOT)
      Controls which locale is used to search for sentence and word boundaries.
This parameter takes a form of a language tag, for example: `"en-US"`, `"fr-FR"`, `"ja-JP"`.
    - `force_source` (boolean)
    - `fragmenter` (enum · default: span)
      Specifies how text should be broken up in highlight snippets: `simple` or `span`.
Only valid for the `plain` highlighter.
      Values: `simple`, `span`
    - `fragment_size` (number · default: 100)
      The size of the highlighted fragment in characters.
    - `highlight_filter` (boolean)
    - `highlight_query` ({} Query)
      Highlight matches for a query other than the search query.
This is especially useful if you use a rescore query because those are not taken into account by highlighting by default.
      See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)
    - `max_fragment_length` (number)
    - `max_analyzed_offset` (number)
      If set to a non-negative value, highlighting stops at this defined maximum limit.
The rest of the text is not processed, thus not highlighted and no error is returned
The `max_analyzed_offset` query setting does not override the `index.highlight.max_analyzed_offset` setting, which prevails when it’s set to lower value than the query setting.
    - `no_match_size` (number · default: 0)
      The amount of text you want to return from the beginning of the field if there are no matching fragments to highlight.
    - `number_of_fragments` (number · default: 5)
      The maximum number of fragments to return.
If the number of fragments is set to `0`, no fragments are returned.
Instead, the entire field contents are highlighted and returned.
This can be handy when you need to highlight short texts such as a title or address, but fragmentation is not required.
If `number_of_fragments` is `0`, `fragment_size` is ignored.
    - `options` (map string to object)
    - `order` (enum · default: none)
      Sorts highlighted fragments by score when set to `score`.
By default, fragments will be output in the order they appear in the field (order: `none`).
Setting this option to `score` will output the most relevant fragments first.
Each highlighter applies its own logic to compute relevancy scores.
      Values: `score`
    - `phrase_limit` (number · default: 256)
      Controls the number of matching phrases in a document that are considered.
Prevents the `fvh` highlighter from analyzing too many phrases and consuming too much memory.
When using `matched_fields`, `phrase_limit` phrases per matched field are considered. Raising the limit increases query time and consumes more memory.
Only supported by the `fvh` highlighter.
    - `post_tags` (string[])
      Use in conjunction with `pre_tags` to define the HTML tags to use for the highlighted text.
By default, highlighted text is wrapped in `<em>` and `</em>` tags.
    - `pre_tags` (string[])
      Use in conjunction with `post_tags` to define the HTML tags to use for the highlighted text.
By default, highlighted text is wrapped in `<em>` and `</em>` tags.
    - `require_field_match` (boolean · default: true)
      By default, only fields that contains a query match are highlighted.
Set to `false` to highlight all fields.
    - `tags_schema` (enum)
      Set to `styled` to use the built-in tag schema.
      Values: `styled`
    - `encoder` (enum)
      Values: `default`, `html`
    - `fields` (union oneOf)
      `map string to object` or `[] map string to object`
  - `script_fields` (map string to object)
    Returns the result of one or more script evaluations for each hit.
    Map values (object)
    - `script` (string)
    - `ignore_failure` (boolean)
  - `size` (number · default: 3)
    The maximum number of top matching hits to return per bucket.
  - `sort` (union oneOf)
    Sort order of the top matching hits.
By default, the hits are sorted by the score of the main query.
    Same options as `sort` in `bucket_sort`
  - `_source` (union oneOf)
    Selects the fields of the source that are returned.
    - **boolean**
    - **SourceFilter**
      - `exclude_vectors` (boolean)
        If `true`, vector fields are excluded from the returned source.

This option takes precedence over `includes`: any vector field will
remain excluded even if it matches an `includes` rule.
      - `excludes` (union oneOf)
        A list of fields to exclude from the returned source.
        One of: `string[]` or `string`
      - `includes` (union oneOf)
        A list of fields to include in the returned source.
        One of: `string[]` or `string`
  - `stored_fields` (union oneOf)
    Returns values for the specified stored fields (fields that use the `store` mapping option).
    One of: `string[]` or `string`
  - `track_scores` (boolean · default: false)
    If `true`, calculates and returns document scores, even if the scores are not used for sorting.
  - `version` (boolean · default: false)
    If `true`, returns document version as part of a hit.
  - `seq_no_primary_term` (boolean)
    If `true`, returns sequence number and primary term of the last modification of each hit.
- `t_test` (object)
  A metrics aggregation that performs a statistical hypothesis test in which the test statistic follows a Student’s t-distribution under the null hypothesis on numeric values extracted from the aggregated documents.
  - `a` (object)
    Test population A.
    - `field` (string)
      The field to aggregate.
    - `script` (string)
    - `filter` ({} Query)
      A filter used to define a set of records to run unpaired t-test on.
      See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)
  - `b` (object)
    Test population B.
    - `field` (string)
      The field to aggregate.
    - `script` (string)
    - `filter` ({} Query)
      A filter used to define a set of records to run unpaired t-test on.
      See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/v9/types/_types-query_dsl-querycontainer)
  - `type` (enum · default: heteroscedastic)
    The type of test.

Supported values include:
  - `paired`: Performs paired t-test.
  - `homoscedastic`: Performs two-sample equal variance test.
  - `heteroscedastic`: Performs two-sample unequal variance test.
    Values: `paired`, `homoscedastic`, `heteroscedastic`
- `top_metrics` (object)
  A metric aggregation that selects metrics from the document with the largest or smallest sort value.
  - `metrics` (union oneOf)
    The fields of the top document to return.
    `object` or `object[]`
    - `field` (string)
      A field to return as a metric.
    - `missing` (boolean | number | string)
      The value to treat a document as having when it has no value for the field.
By default, a document that is missing any of the metrics or the sort value is ignored.
  - `size` (number · default: 1)
    The number of top documents from which to return metrics.
  - `sort` (union oneOf)
    The sort order of the documents.
    Same options as `sort` in `bucket_sort`
- `value_count` (object)
  A single-value metrics aggregation that counts the number of values that are extracted from the aggregated documents.
  - `field` (string)
    The field on which to run the aggregation.
  - `missing` (boolean | number | string)
    The value to apply to documents that do not have a value.
By default, documents without a value are ignored.
  - `script` (string)
  - `format` (string)
- `weighted_avg` (object)
  A single-value metrics aggregation that computes the weighted average of numeric values that are extracted from the aggregated documents.
  - `format` (string)
    A numeric response formatter.
  - `value` (object)
    Configuration for the field that provides the values.
    - `field` (string)
      The field from which to extract the values or weights.
    - `missing` (number)
      A value or weight to use if the field is missing.
    - `script` (string)
  - `value_type` (enum)
    Values: `string`, `long`, `double`, `number`, `date`, `date_nanos`, `ip`, `numeric`, `geo_point`, `boolean`
  - `weight` (object)
    Configuration for the field or script that provides the weights.
    - `field` (string)
      The field from which to extract the values or weights.
    - `missing` (number)
      A value or weight to use if the field is missing.
    - `script` (string)
- `variable_width_histogram` (object)
  A multi-bucket aggregation similar to the histogram, except instead of providing an interval to use as the width of each bucket, a target number of buckets is provided.
  - `field` (string)
    The name of the field.
  - `buckets` (number · default: 10)
    The target number of buckets.
  - `shard_size` (number)
    The number of buckets that the coordinating node will request from each shard.
Defaults to `buckets * 50`.
  - `initial_buffer` (number)
    Specifies the number of individual documents that will be stored in memory on a shard before the initial bucketing algorithm is run.
Defaults to `min(10 * shard_size, 50000)`.
  - `script` (string)