OpenSearch/docs/reference/migration/migrate_5_0/aggregations.asciidoc

[[breaking_50_aggregations_changes]]
=== Aggregation changes

==== Significant terms on numeric fields

Numeric fields have been refactored to use a different data structure that
performs better for range queries. However, since this data structure does
not record document frequencies, numeric fields can no longer be used for
significant terms aggregations. It is recommended to use <<keyword,`keyword`>>
fields instead, either directly or through a <<multi-fields,multi-field>>
if the numeric representation is still needed for sorting, range queries or
numeric aggregations like
<<search-aggregations-metrics-stats-aggregation,`stats` aggregations>>.
Use the new points API to index numeric fields. #17746 This makes all numeric fields including `date`, `ip` and `token_count` use points instead of the inverted index as a lookup structure. This is expected to perform worse for exact queries, but faster for range queries. It also requires less storage. Notes about how the change works: - Numeric mappers have been split into a legacy version that is essentially the current mapper, and a new version that uses points, eg. LegacyDateFieldMapper and DateFieldMapper. - Since new and old fields have the same names, the decision about which one to use is made based on the index creation version. - If you try to force using a legacy field on a new index or a field that uses points on an old index, you will get an exception. - IP addresses now support IPv6 via Lucene's InetAddressPoint and store them in SORTED_SET doc values using the same encoding (fixed length of 16 bytes and sortable). - The internal MappedFieldType that is stored by the new mappers does not have any of the points-related properties set. Instead, it keeps setting the index options when parsing the `index` property of mappings and does `if (fieldType.indexOptions() != IndexOptions.NONE) { // add point field }` when parsing documents. Known issues that won't fix: - You can't use numeric fields in significant terms aggregations anymore since this requires document frequencies, which points do not record. - Term queries on numeric fields will now return constant scores instead of giving better scores to the rare values. Known issues that we could work around (in follow-up PRs, this one is too large already): - Range queries on `ip` addresses only work if both the lower and upper bounds are inclusive (exclusive bounds are not exposed in Lucene). We could either decide to implement it, or drop range support entirely and tell users to query subnets using the CIDR notation instead. - Since IP addresses now use a different representation for doc values, aggregations will fail when running a terms aggregation on an ip field on a list of indices that contains both pre-5.0 and 5.0 indices. - The ip range aggregation does not work on the new ip field. We need to either implement range aggs for SORTED_SET doc values or drop support for ip ranges and tell users to use filters instead. #17700 Closes #16751 Closes #17007 Closes #11513 2016-04-01 11:07:35 +02:00			`[[breaking_50_aggregations_changes]]`
			`=== Aggregation changes`

			`==== Significant terms on numeric fields`

			`Numeric fields have been refactored to use a different data structure that`
			`performs better for range queries. However, since this data structure does`
			`not record document frequencies, numeric fields can no longer be used for`
			significant terms aggregations. It is recommended to use <<keyword,`keyword`>>
			`fields instead, either directly or through a <<multi-fields,multi-field>>`
			`if the numeric representation is still needed for sorting, range queries or`
			`numeric aggregations like`
			<<search-aggregations-metrics-stats-aggregation,`stats` aggregations>>.