聚合弹性搜索中存储桶的字符串排序

Question

我想按包含字符串值的字段对结果进行排序，例如，我的响应是这样的

"aggregations": {
    "group_agg": {
        "doc_count_error_upper_bound": -1,
        "sum_other_doc_count": 82,
        "buckets": [
            {
                "key": "38:16:33:6A:71:FF",
                "doc_count": 1,
                "group_agg_top_hit": {
                    "hits": {
                        "total": 1,
                        "max_score": null,
                        "hits": [
                            {
                                "_index": "23432534534",
                                "_type": "log",
                                "_id": "123143435346",
                                "_score": null,
                                "_source": {
                                    "name1": "aaa-bbb",
                                    "name2": "asdasd-bbb",
                                    "Mac": "38:22:33:6A:71:FF",
                                    "description": "",
                                    "event_timestamp": "2017-12-16T08:06:10.000+0000",
                                    "ssid": "aaa-network"
                                },
                                "sort": [
                                    1513411570000
                                ]
                            }
                        ]
                    }
                },
                "order_agg": {
                    "value": 1513411570000,
                    "value_as_string": "2017-12-16T08:06:10.000Z"
                }
            }
        ]
    }
}

我用time_stamp对它进行了排序，这是一个气动数值，我需要用来对结果进行排序。

======================================

 "aggs": {
"group_agg": {
  "terms": {
    "field": "Mac.rawData",
    "size": 1,
     "order" : { "order_agg" : "asc" }   ----> need to change this to make sorting by name 1 or name 2

  },
  "aggs": {
    "order_agg": {
      "max": {
        "field": "event_timestamp"
      }
    },
    "group_agg_top_hit": {
      "top_hits": {
      "sort": [
                {
                    "event_timestamp": {
                        "order": "desc"
                    }
                }
            ],
            "_source": {
                "includes": ["name1", "name2", "Mac", "ssid", "event_timestamp","description"]
            },
        "size": 1
      }
    }
  }
}

}

====此代码正常工作，但我需要将存储桶排序更改为按名称而不是event_timestamp排序

请帮帮忙

Answer 1

如果你使用的是高于6.x的ES版本，那么你可以使用复合聚合。它接受文本搜索，但它的工作方式与TermAggregation略有不同：

https://www.elastic.co/guide/en/elasticsearch/reference/6.7/search-aggregations-bucket-composite-aggregation.html

Answer 2

我也曾尝试过这样做，但是没有成功，因为所有的单值度量聚合，如max、avg等，都要求被聚合的字段是integer类型。

您可能遇到过这种情况，并且像我一样正在寻找外部帮助；希望其他人看到您的这篇文章，并指出一个聚合解决方案，或者至少是可以按text字段对存储桶进行排序的替代方案或最佳实践。