Use metric aggregations for <<maps-vector-style-data-driven, data driven styling>>. For example, use the count aggregation to shade world countries by web log traffic.
* *Percentile.* The value at which a certain percentage of observed values occur. For example, the 95th percentile is the value which is greater than 95% of the observed values.
Use aggregated layers with document layers to show aggregated views when the map shows larger
amounts of the globe and individual documents when the map shows smaller regions.
In the following example, the Grid aggregation layer is only visible when the map is at zoom levels 0 through 5. The Documents layer is only visible when the map is at zoom levels 4 through 24.
See the <<maps-add-elasticsearch-layer, Getting started>> tutorial for more details on configuring the layers.
Grid aggregation layers use {ref}/search-aggregations-bucket-geotilegrid-aggregation.html[GeoTile grid aggregation] to group your documents into grids. You can calculate metrics for each gridded cell.
To get this data, {es} first groups your data using a {ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation],
then accumulates the most relevant documents based on sort order for each entry using a {ref}/search-aggregations-metrics-top-hits-aggregation.html[top hits metric aggregation].
The cloropeth example uses the shared key, https://wikipedia.org/wiki/ISO_3166-1_alpha-2[ISO 3166-1 alpha-2 code], to join world countries and web log traffic.
ISO 3166-1 alpha-2 code is an international standard that identifies countries by a two-letter country code.
For example, *Sweden* has an ISO 3166-1 alpha-2 code of *SE*.
The left source for the term join is the https://www.elastic.co/elastic-maps-service[Elastic Maps Service (EMS)] World Countries. Vector features for this source are provided by EMS. You can also use your own vector features.
In the following example, *iso2* property defines the shared key for the left source.
The right source uses the Kibana sample data set "Sample web logs".
In this data set, the *geo.src* field contains the ISO 3166-1 alpha-2 code of the country of origin.
A {ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation] groups the sample web log documents by *geo.src* and calculates metrics for each term.
The METRICS configuration defines two metric aggregations:
* The count of all documents in the terms bucket.
* The average of the field "bytes" for all documents in the terms bucket.
[role="screenshot"]
image::maps/images/terms_join_metric_config.png[]
The right source does not provide individual documents, but instead provides the metrics from a terms aggregation.
The metrics are calculated from the following sample web logs documents.
The join adds metrics for each terms aggregation bucket to the world country feature with the corresponding ISO 3166-1 alpha-2 code. Features that do not have a corresponding terms aggregation bucket are not visible on the map.
The world country features now have two additional properties:
* Count of web log traffic originating from the world country
* Average bytes of web log traffic originating from the world country