有没有一种方法可以按 'order' 字段对 Elasticsearch 进行百分位聚合排序？

Question

我正在尝试通过 order 字段对百分位数的子聚合进行排序（当我运行它在 avg/sum 聚合时有效）

{
  "size": 0,
  "_source": false,
  "stored_fields": "_none_",
  "aggregations": {
    "aggs": {
      "terms": {
        "field": "field",
        "size": 100,
        "min_doc_count": 1,
        "shard_min_doc_count": 0,
        "show_term_doc_count_error": false,
        "order": [
          {
            "sub_aggs": "asc"
          },
          {
            "_key": "asc"
          }
        ]
      },
      "aggregations": {
        "sub_aggs": {
          "percentiles": {
            "field": "sub_agg_field",
            "percents": [95],
            "keyed": true,
            "tdigest": {
              "compression": 100
            }
          }
        }
      }
    }
  }
}

但是当我运行它时，我得到下一个错误：

{
  "error": {
    "root_cause": [
      {
        "type": "aggregation_execution_exception",
        "reason": "Invalid aggregation order path [sub_aggs]. When ordering on a multi-value metrics aggregation a metric name must be specified"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "some_index",
        "node": "xJIpW6KTSMuL41-zu9um-w",
        "reason": {
          "type": "aggregation_execution_exception",
          "reason": "Invalid aggregation order path [sub_aggs]. When ordering on a multi-value metrics aggregation a metric name must be specified"
        }
      }
    ]
  },
  "status": 500
}

问题是我如何在多值聚合中做到这一点（如果它不像在单一聚合中那样工作）？

Answer 1

文档包含有关如何按多值聚合排序的指南https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-order

Ordering the buckets by multi value metrics sub-aggregation (identified by the aggregation name):

GET /_search
{
  "aggs": {
    "genres": {
      "terms": {
        "field": "genre",
        "order": { "playback_stats.max": "desc" }
      },
      "aggs": {
        "playback_stats": { "stats": { "field": "play_count" } }
      }
    }
  }
}

所以也许这会起作用？

{
  "size": 0,
  "_source": false,
  "stored_fields": "_none_",
  "aggregations": {
    "aggs": {
      "terms": {
        "field": "field",
        "size": 100,
        "min_doc_count": 1,
        "shard_min_doc_count": 0,
        "show_term_doc_count_error": false,
        "order": [
          {
            "sub_aggs.95": "asc"
          },
          {
            "_key": "asc"
          }
        ]
      },
      "aggregations": {
        "sub_aggs": {
          "percentiles": {
            "field": "sub_agg_field",
            "percents": [95],
            "keyed": true,
            "tdigest": {
              "compression": 100
            }
          }
        }
      }
    }
  }
}

有没有一种方法可以按 'order' 字段对 Elasticsearch 进行百分位聚合排序？

Is there a way to sort percentile aggregation by 'order' field is Elasticsearch?

elasticsearch

aggregation

elasticsearch-aggregation