How do I sort buckets by Term Aggregation's nested doc_count?

问题

I have an index, invoices, that I need to aggregate into yearly buckets then sort.

I have succeeded in using Bucket Sort to sort my buckets by simple sum values (revenue and tax). However, I am struggling to sort by more deeply nested doc_count values (status).

I want to order my buckets not only by revenue, but also by the number of docs with a status field equal to 1, 2, 3 etc...

The documents in my index looks like this:

"_source": {
  "created_at": "2018-07-07T03:11:34.327Z",
  "status": 3,
  "revenue": 68.474,
  "tax": 6.85,
}

I request my aggregations like this:

const params = {
  index: 'invoices',
  size: 0,
  body: {
    aggs: {
      sales: {
        date_histogram: {
          field: 'created_at',
          interval: 'year',
        },
        aggs: {
          total_revenue: { sum: { field: 'revenue' } },
          total_tax: { sum: { field: 'tax' } },
          statuses: {
            terms: {
              field: 'status',
            },
          },
          sales_bucket_sort: {
            bucket_sort: {
              sort: [{ total_revenue: { order: 'desc' } }],
            },
          },
        },
      },
    },
  },
}

The response (truncated) looks like this:

"aggregations": {
    "sales": {
        "buckets": [
            {
                "key_as_string": "2016-01-01T00:00:00.000Z",
                "key": 1451606400000,
                "doc_count": 254,
                "total_tax": {
                    "value": 735.53
                },
                "statuses": {
                    "sum_other_doc_count": 0,
                    "buckets": [
                        {
                            "key": 2,
                            "doc_count": 59
                        },
                        {
                            "key": 1,
                            "doc_count": 58
                        },
                        {
                            "key": 5,
                            "doc_count": 57
                        },
                        {
                            "key": 3,
                            "doc_count": 40
                        },
                        {
                            "key": 4,
                            "doc_count": 40
                        }
                    ]
                },
                "total_revenue": {
                    "value": 7355.376005351543
                }
            },
          ]
        }
      }

I want to sort by key: 1, for example. Order the buckets according to which one has the greatest number of docs with a status value of 1. I tried to order my terms aggregation, then specify the desired key like this:

          statuses: {
            terms: {
              field: 'status',
              order: { _key: 'asc' },
            },
          },
          sales_bucket_sort: {
            bucket_sort: {
              sort: [{ 'statuses.buckets[0]._doc_count': { order: 'desc' } }],
            },
          },

However this did not work. It didn't error, it just doesn't seem to have any effect.

I noticed someone else on SO had a similar question many years ago, but I was hoping a better answer had emerged since then: Elasticsearch aggregation. Order by nested bucket doc_count

Thanks!

回答1:

Nevermind I figured it out. I added a separate filter aggregation like this:

        aggs: {
          total_revamnt: { sum: { field: 'revamnt' } },
          total_purchamnt: { sum: { field: 'purchamnt' } },
          approved_invoices: {
            filter: {
              term: {
                status: 1,
              },
            },
          },

Then I was able to bucket sort that value like this:

          sales_bucket_sort: {
            bucket_sort: {
                sort: [{ 'approved_invoices>_count': { order: 'asc' } }],
            },
          },

来源：https://stackoverflow.com/questions/51952843/how-do-i-sort-buckets-by-term-aggregations-nested-doc-count