elasticsearch嵌套聚合的排序和顺序

Question

我希望为存储桶聚合的每个桶聚合嵌套字段的字段，并对具有子聚合结果的桶进行排序和筛选。我有一个在非嵌套字段上工作的查询。

aggs = {
    "account": {
        "terms": {
            "field": "to.keyword",
            "order": { "total_amount": "desc"},
            "size": 100,
            "min_doc_count": 20,
        },
        "aggs": {
            "total_amount": {
                "sum": {
                    "field": "balance_diffs.diff_balance_usd"
                }
            },
            "neg_amount_filter": {
                "bucket_selector": {
                    "buckets_path": {
                        "totalAmount": "total_amount"
                    },
                    "script": "params.totalAmount > 0"
                }
            }
        }
    }
}

我试图转换为嵌套聚合，但有两个问题：

aggs = {
        "account": {
            "terms": {
                "field": "to.keyword",
                "order": { "amount": "desc"},
                "size": 100,
                "min_doc_count": 20,
            },
            "aggs": {
                "total_amount": {
                    "nested": {
                        "path": "balance_diffs"
                    },
                    "aggs": {
                        "amount": {
                            "sum": {
                                "field": "balance_diffs.diff_balance_usd"
                            },
                        },
                        "accounts_bucket_sort": {
                            "bucket_sort": {
                                "sort": [
                                    { "amount.value": { "order": "desc" } } 
                                ],
                            }
                        }
                    }
                },
            }
        }
    }

1-无法在order语句的顶层访问"total_amount“

2- "neg_amount_filter“创建"search_phase_execution_exception”异常

如果我删除这两个部分，agg工作，但我不能过滤和排序的结果。

我也尝试使用reverse_nested和"multi_bucket_emulation“，这在另一篇文章中有描述，但我仍然有"search_phase_execution_exception”错误。

aggs = {
    "contract": {
        "terms": {
            "field": "to.keyword",
            "size": 100,
            "min_doc_count": 20,
        },
        "aggs": {
            "total_profit": {
                "nested": {
                    "path": "balance_diffs"
                },
                "aggs": {
                    "profit": {
                        "sum": {
                            "field": "balance_diffs.diff_balance_usd"
                        },
                    },
                    "back_to_parent": {
                        "reverse_nested": {},
                        "aggs": {
                            "multi_bucket_emulator": {
                                "filters": {
                                    "filters": {
                                            "placeholder_match_all_query": {
                                            "match_all": {}
                                        }
                                    }
                                },
                                "aggs": {
                                    "contracts_bucket_sort": {
                                        "bucket_sort": {
                                            "sort": [
                                                { "profit": { "order": "desc" } } 
                                            ],
                                        }
                                    }
                                }
                            },
                        }
                    }
                }
            },
        }
    }
}

Answer 1

您可以通过嵌套子聚合来排序术语聚合。为了提供完整的路径"total_amount>amount“，而不是”“。

{
  "aggs": {
    "account": {
      "terms": {
        "field": "to.keyword",
        "order": {
          "total_amount>amount": "desc"
        },
        "size": 100,
        "min_doc_count": 20
      },
      "aggs": {
        "total_amount": {
          "nested": {
            "path": "balance_diffs"
          },
          "aggs": {
            "amount": {
              "sum": {
                "field": "balance_diffs.diff_balance_usd"
              }
            },
            "accounts_bucket_sort": {
              "bucket_sort": {
                "sort": [
                  {
                    "amount.value": {
                      "order": "desc"
                    }
                  }
                ]
              }
            }
          }
        }
      }
    }
  }
}