CODEWITHSUNDEEP
elasticsearchkibana
dcolazin
dcolazin

Reputation: 1084

Order by doc_count in composite aggregation (or suitable alternatives)

I have a search like the following

{
    "size": 0,
    "query": { "...": "..." },
    "_source": false,
    "aggregations": {
        "agg1": { "...": "..." },
        "agg2": { "...": "..." }
    }
}

where agg* is composite aggregation of the kind

"agg1" : {
    "composite": {
        "size": 300,
        "sources": [
            {
                "field1": {
                    "terms": {
                        "field": "field1.keyword",
                        "missing_bucket": true,
                    }
                }
            },
            {
                "field2": {
                    "terms": {
                        "field": "field2.keyword",
                        "missing_bucket": true,
                        "order": "asc"
                    }
                }
            }
        ]
    },
    "aggregations": {
        "field3": {
            "filter": { "term": { "field3.keyword": "xyz" } }
        }
    }
}

I want to order by doc_count of the buckets as I don't need all the buckets, but just the top n, like what happens in some Kibana visualizations. From the documentation of composite aggregations it doesn't seem possible to order the results similarly at what happens with terms aggregations. Is there a workaround or alternative queries to do this?

Upvotes: 0

Views: 284

Answers (1)

dcolazin
dcolazin

Reputation: 1084

A (ugly) workaround is to define a bucket sort pipeline aggregation and sort for id count:

{
    "size": 0,
    "query": { "...": "..." },
    "_source": false,
    "aggregations": {
        "agg1": {
            "composite": {
                "size": 100,
                "sources": [
                     {
                        "field1": {
                            "terms": {
                                "field": "field1.keyword",
                                "missing_bucket": true
                            }
                        }
                    },
                    {
                        "field2": {
                            "terms": {
                                "field": "field2.keyword",
                                "missing_bucket": true
                            }
                        }
                    }
                ]
            },
            "aggs": {
                "agg1_sort": {
                    "bucket_sort": {
                        "sort": [
                            {
                                "agg1_doc_number": {
                                    "order": "desc"
                                }
                            }
                        ]
                    }
                },
                "agg1_doc_number": {
                    "value_count": {
                        "field": "_id"
                    }
                }
            }
        }
    }
}

Upvotes: 0

Related Questions