2
votes

How do i sort elasticsearch aggregations buckets on keys. I have nested aggregations and want to sort on my 2nd aggregation buckets result.

Like I have:

"result": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": [
            {
               "key": 20309,
               "doc_count": 752,
               "Events": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "impression",
                        "doc_count": 30
                     },
                     {
                        "key": "page_view",
                        "doc_count": 10
                     },
                     ...
                  ]
               }
            },
            {
               "key": 20771,
               "doc_count": 46,
               "Events": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "impression",
                        "doc_count": 32
                     },
                     {
                        "key": "page_view",
                        "doc_count": 9
                     },
                     ...
                  ]
               }
            },

I want my Events aggregate buckets to sort by desc/asc on key impression or on page_view. How do I achieve such results set?

Here is my query

GET someindex/useractivity/_search?search_type=count
{
  "size": 1000000,
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "created_on": {
                  "from": "2015-01-12",
                  "to": "2016-05-12"
                }
              }
            },
            {
              "term": {
                "group_id": 1
              }
            }
          ]
        }
      }
    }
  },
  "aggs": {
    "result": {
      "terms": {
        "field": "entity_id",
        "size": 1000000
      },
      "aggs": {
        "Events": {
          "terms": {
            "field": "event_type",
            "min_doc_count": 0,
            "size": 10
          }
        }
      }
    }
  }
}

I have tried using _key, but it sort within the bucket. I want to sort by looking at all buckets. Like I have a key impression. I want my buckets result to be sorted with this key. Not within the bucket.

I want my results set to be like if I want to sort on impression by descending order then my result should be

"buckets": [
                {
                   "key": 20771,
                   "doc_count": 46,
                   "Events": {
                      "doc_count_error_upper_bound": 0,
                      "sum_other_doc_count": 0,
                      "buckets": [
                         {
                            "key": "impression",
                            "doc_count": 32
                         },
                         {
                            "key": "page_view",
                            "doc_count": 9
                         },
                         ...
                      ]
                   }
                },
                {                       
                   "key": 20309,
                   "doc_count": 752,
                   "Events": {
                      "doc_count_error_upper_bound": 0,
                      "sum_other_doc_count": 0,
                      "buckets": [
                         {
                            "key": "impression",
                            "doc_count": 30
                         },
                         {
                            "key": "page_view",
                            "doc_count": 10
                         },
                         ...
                      ]
                   }
                },

i.e the bucket with maximum impression should be on top. (order buckets by impression in descending order)

1
Please share the query you are running.Richa
By using "order": { "_key" : "asc" } or am I missing something?Andrei Stefan
using _key will sort within the bucket. I want to sort it with all buckets. Like I have a key impression . I want my buckets result to be sorted with this key. Not within the bucketyakhtarali
Can you change the output of that aggregation and show what is the desired result?Andrei Stefan
@Andrei Stefan I have updated my questionyakhtarali

1 Answers

0
votes

Try this aggregation:

{
  "size": 0,
  "aggs": {
    "result": {
      "terms": {
        "field": "entity_id",
        "size": 10,
        "order": {
          "impression_Events": "desc"
        }
      },
      "aggs": {
        "Events": {
          "terms": {
            "field": "event_type",
            "min_doc_count": 0,
            "size": 10
          }
        },
        "impression_Events": {
          "filter": {
            "term": {
              "event_type": "impression"
            }
          }
        }
      }
    }
  }
}