doc_count订购复合汇总（或合适的替代方案）

发布于 2025-01-30 14:30:10 字数 1549 浏览 2 评论 0 原文

我有以下搜索

{
    "size": 0,
    "query": { "...": "..." },
    "_source": false,
    "aggregations": {
        "agg1": { "...": "..." },
        "agg2": { "...": "..." }
    }
}

，其中 agg*是我想要通过doc_count订购的合成汇总

"agg1" : {
    "composite": {
        "size": 300,
        "sources": [
            {
                "field1": {
                    "terms": {
                        "field": "field1.keyword",
                        "missing_bucket": true,
                    }
                }
            },
            {
                "field2": {
                    "terms": {
                        "field": "field2.keyword",
                        "missing_bucket": true,
                        "order": "asc"
                    }
                }
            }
        ]
    },
    "aggregations": {
        "field3": {
            "filter": { "term": { "field3.keyword": "xyz" } }
        }
    }
}

，因为我不需要所有的存储桶，而只是顶部n，就像什么一样发生在一些基巴纳可视化中。摘自似乎不可能以 enker contregations 。是否有解决方法或替代疑问？

原文

I have a search like the following

{
    "size": 0,
    "query": { "...": "..." },
    "_source": false,
    "aggregations": {
        "agg1": { "...": "..." },
        "agg2": { "...": "..." }
    }
}

where agg* is composite aggregation of the kind

"agg1" : {
    "composite": {
        "size": 300,
        "sources": [
            {
                "field1": {
                    "terms": {
                        "field": "field1.keyword",
                        "missing_bucket": true,
                    }
                }
            },
            {
                "field2": {
                    "terms": {
                        "field": "field2.keyword",
                        "missing_bucket": true,
                        "order": "asc"
                    }
                }
            }
        ]
    },
    "aggregations": {
        "field3": {
            "filter": { "term": { "field3.keyword": "xyz" } }
        }
    }
}

I want to order by doc_count of the buckets as I don't need all the buckets, but just the top n, like what happens in some Kibana visualizations. From the documentation of composite aggregations it doesn't seem possible to order the results similarly at what happens with terms aggregations. Is there a workaround or alternative queries to do this?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

花之痕靓丽 2025-02-06 14:30:10

一个（丑陋的）解决方法是定义a 桶排序管道聚合，并为ID计数排序：

{
    "size": 0,
    "query": { "...": "..." },
    "_source": false,
    "aggregations": {
        "agg1": {
            "composite": {
                "size": 100,
                "sources": [
                     {
                        "field1": {
                            "terms": {
                                "field": "field1.keyword",
                                "missing_bucket": true
                            }
                        }
                    },
                    {
                        "field2": {
                            "terms": {
                                "field": "field2.keyword",
                                "missing_bucket": true
                            }
                        }
                    }
                ]
            },
            "aggs": {
                "agg1_sort": {
                    "bucket_sort": {
                        "sort": [
                            {
                                "agg1_doc_number": {
                                    "order": "desc"
                                }
                            }
                        ]
                    }
                },
                "agg1_doc_number": {
                    "value_count": {
                        "field": "_id"
                    }
                }
            }
        }
    }
}

A (ugly) workaround is to define a bucket sort pipeline aggregation and sort for id count:

{
    "size": 0,
    "query": { "...": "..." },
    "_source": false,
    "aggregations": {
        "agg1": {
            "composite": {
                "size": 100,
                "sources": [
                     {
                        "field1": {
                            "terms": {
                                "field": "field1.keyword",
                                "missing_bucket": true
                            }
                        }
                    },
                    {
                        "field2": {
                            "terms": {
                                "field": "field2.keyword",
                                "missing_bucket": true
                            }
                        }
                    }
                ]
            },
            "aggs": {
                "agg1_sort": {
                    "bucket_sort": {
                        "sort": [
                            {
                                "agg1_doc_number": {
                                    "order": "desc"
                                }
                            }
                        ]
                    }
                },
                "agg1_doc_number": {
                    "value_count": {
                        "field": "_id"
                    }
                }
            }
        }
    }
}

回复收藏 0 原文

~没有更多了~