Here is how to write a simple sum aggregation:

GET bigginsight/_search?track_total_hits=true
{
 "aggregations": {                     1
    "download_sum": {                  2
      "sum": {                         3
        "field": "downloadTotal"       4
      }      
    }
  },
  "size": 0                            5
}

The key parts from the preceding code are explained in the following points:

• The aggs or aggregations element at the top level should wrap any aggregation.
• Give a name to the aggregation; here, we are doing the sum aggregation on the downloadTotal field, and hence, the name we chose was download_sum. You can name it anything. This field will be useful while looking up this particular aggregation's result in the response.
• We are doing a sum aggregation; hence, we have the sum element.
• We want to do terms aggregation on the downloadTotal field.
• Specify size = 0 to prevent raw search results from being returned. We just want aggregation results, and not the search results, in this case. Since we haven't specified any top-level query elements, it matches all documents. We do not want any raw documents (or search hits) in the result.

The response should look like the following:

{
  "took": 92,
  ...
  "hits": {
    "total" : {
      "value" : 242836,          1
      "relation" : "eq"
    },             1
    "max_score": 0,
    "hits": []
  },
  "aggregations": {              2
    "download_sum": {            3
      "value": 2197438700        4
    }
  }
}

Let's go over the key aspects of the response. The key parts are numbered 1, 2, 3, and so on, and are explained in the following points:

• The hits.total element shows the number of documents that were considered or were in the context of the query. If there was no additional query or filter specified, it will include all of the documents in the type or index. We passed ?track_total_hits=true in the request, and hence, you will see the exact count of total hits in the index.

• Just like the request, this response is wrapped inside aggregations to indicate them.
• The response of the aggregation we requested was named download_sum; hence, we get our response from the sum aggregation inside an element with the same name.
• This is the actual value after applying the sum aggregation.

The average, min, and max aggregations are very similar. Let's look at them briefly.