[DOC] Callout the aggregation result may be approximate

Signed-off-by: Lantao Jin <ltjin@amazon.com>

Author: LantaoJin

docs/user/ppl/cmd/stats.rst

@@ -68,6 +68,39 @@ The stats command supports the following aggregation functions:
 
 For detailed documentation of each function, see `Aggregation Functions <../functions/aggregations.rst>`_.
 
+Limitations:
+============
+
+The bucket aggregation result may be approximate in large dataset
+-----------------------------------------------------------------
+
+In OpenSearch, ``doc_count`` values for a terms bucket aggregation may be approximate. As a result, any aggregations (such as ``sum`` and ``avg``) on the terms bucket aggregation may also be approximate.
+For example, the following PPL query (find the top 10 URLs) may return an approximate result if the cardinality of ``URL`` is high.
+
+PPL query::
+
+    > source=hits
+      | stats bucket_nullable=false count() as c by URL
+      | sort - c
+      | head 10
+
+This query is pushed down to a terms bucket aggregation DSL query with ``"order": { "_count": "desc" }``. In OpenSearch, this terms aggregation may throw away some buckets.
+
+
+Sorting by ascending doc_count may produce inaccurate results
+-------------------------------------------------------------
+
+Similar to above PPL query, the following query (find the rare 10 URLs) often produces inaccurate results.
+
+PPL query::
+
+    > source=hits
+      | stats bucket_nullable=false count() as c by URL
+      | sort + c
+      | head 10
+
+A term that is globally infrequent might not appear as infrequent on every individual shard or might be entirely absent from the least frequent results returned by some shards. Conversely, a term that appears infrequently on one shard might be common on another. In both scenarios, rare terms can be missed during shard-level aggregation, resulting in incorrect overall results.
+
 Example 1: Calculate the count of events
 ========================================
 

docs/user/ppl/functions/aggregations.rst

@@ -11,7 +11,7 @@ Aggregation Functions
 
 Description
 ============
-| Aggregation functions perform calculations across multiple rows to return a single result value. These functions are used with ``stats`` and ``eventstats`` commands to analyze and summarize data.
+| Aggregation functions perform calculations across multiple rows to return a single result value. These functions are used with ``stats``, ``eventstats`` and ``streamstats`` commands to analyze and summarize data.
 
 | The following table shows how NULL/MISSING values are handled by aggregation functions:
 

docs/user/ppl/index.rst

@@ -102,7 +102,7 @@ The query start with search command and then flowing a set of command delimited
 
 * **Functions**
 
-  - `Aggregation Functions <functions/aggregation.rst>`_
+  - `Aggregation Functions <functions/aggregations.rst>`_
 
   - `Collection Functions <functions/collection.rst>`_