Every bucket aggregation returns an exact count — no HyperLogLog approximations in the bucket path. The one deliberate exception is the sampling family below (sampler, random_sampler, diversified_sampler), which is a sample by definition: it truncates to the top shard_size matched documents by _score, and its sub-aggregations see only that slice. Once an index passes 10,000 live documents, terms and the other columnar-eligible aggregations read a doc-values ordinal histogram instead of scanning postings (fast_aggs.rs); below that the JSON path answers directly and stays the reference implementation.
The list below is the complete set of aggregation keys the engine dispatches, generated from xerj_engine::aggs::SUPPORTED_AGG_TYPES and held to it by a test. Being listed means the aggregation runs and returns the ES response shape — it is not a promise that every parameter of every type is honoured.
Metric aggregations
avg
sum
min
max
statsmin, max, sum, count, avg in one pass.
extended_stats
value_count
cardinalityExact — every distinct value goes into a hash set, so memory grows with cardinality.
percentilesLinear interpolation over the sorted values; the hdr option switches to HdrHistogram nearest-rank.
percentile_ranks
median_absolute_deviation
boxplot
string_stats
matrix_stats
top_hits
top_metrics
scripted_metricinit / map / combine / reduce in Painless.
geo_bounds
geo_centroid
Bucket aggregations
termsExact counts, served from the doc-values ordinal histogram above 10k docs.
multi_terms
rare_terms
significant_terms
significant_text
rangeNumeric ranges.
date_rangeRanges with date math.
ip_range
ip_prefix
histogramFixed-interval buckets.
date_histogramTime-bucketed counts.
auto_date_histogram
variable_width_histogram
filterSingle-filter bucket.
filtersNamed or anonymous multi-filter buckets.
missingNull / absent field bucket.
globalSub-aggs run over every document, ignoring the query.
nested
reverse_nested
adjacency_matrix
compositeMulti-source pagination.
geo_distance
geohash_grid
geotile_grid
samplerThe one deliberate exception to exactness: keeps the top shard_size matched docs by _score (default 200), so sub-aggregations run over that sample.
diversified_samplerSame truncation, plus a cap of max_docs_per_value docs sharing one field value (default 1).
random_samplerShares the sampler implementation — same top-by-_score slice; ES's probability parameter is not read.
time_series
Pipeline aggregations
Computed in a second pass over the bucket tree the aggregations above produce, so they take a buckets_path rather than a field.
avg_bucket
max_bucket
min_bucket
sum_bucket
stats_bucket
extended_stats_bucket
percentiles_bucket
derivative
cumulative_sum
moving_avg
moving_fn
serial_diff
bucket_scriptPainless expression over sibling metrics in the same bucket.
bucket_selectorDrops buckets whose script predicate is false.