GeoHash grid aggregation uses the GeoHash mechanism to divide the map into smaller units. You can read about GeoHash at https://en.wikipedia.org/wiki/Geohash. The GeoHash system divides the world map into a grid of rectangular regions of different precisions. Lower values of precision represent larger geographical areas, while higher values represent smaller, more precise geographical areas:

GET bigginsight/_search?size=0
{
  "aggs": {
    "geo_hash": {
      "geohash_grid": {
        "field": "location",
        "precision": 7
      }
    }
  }
}

The data that we have in our network traffic example is spread over a very small geographical area, so we have used a precision of 7. The supported values for precision are from 1 to 12. Let's look at the response to this request:

{
  ...,
  "aggregations": {
    "geo_hash": {
      "buckets": [
        {
          "key": "ts5e7vy",
          "doc_count": 161893
        },
        {
          "key": "ts5e7vw",
          "doc_count": 80942
        }
      ]
    }
  }
}

After aggregating the data onto GeoHash blocks of "precision": 7, all the documents fell into two GeoHash regions, with the respective document counts seen in the response. We can zoom in on this map or request the data to be aggregated on smaller hashes, by increasing the value of the precision.

When you try a precision value of 9, you will see the following response:

{
  ...,
  "aggregations": {
    "geo_hash": {
      "buckets": [
        {
          "key": "ts5e7vy80k",
          "doc_count": 131034
        },
        {
          "key": "ts5e7vwrdb",
          "doc_count": 60953
        },
        {
          "key": "ts5e7vy84c",
          "doc_count": 30859
        },
        {
          "key": "ts5e7vwxfn",
          "doc_count": 19989
        }
      ]
    }
  }
}

As you can see, the GeoHash grid aggregation allows you to slice or aggregate the data over geographical regions of different sizes/precisions, which is quite powerful. This data can be visualized in Kibana, or it can be used in your application with a library that can render the data on a map.

We have covered a wide variety of bucket aggregations that let us slice and dice data on fields of various datatypes. We also looked at how to aggregate over text data, numerical data, dates/times, and geospatial data. Next, we will look at what pipeline aggregations are.