我想为存储桶聚合的每个存储桶聚合嵌套字段的字段,并使用子聚合结果对存储桶进行排序和筛选。我有一个在非嵌套字段上工作的查询。
aggs = {
"account": {
"terms": {
"field": "to.keyword",
"order": { "total_amount": "desc"},
"size": 100,
"min_doc_count": 20,
},
"aggs": {
"total_amount": {
"sum": {
"field": "balance_diffs.diff_balance_usd"
}
},
"neg_amount_filter": {
"bucket_selector": {
"buckets_path": {
"totalAmount": "total_amount"
},
"script": "params.totalAmount > 0"
}
}
}
}
}
我尝试转换为嵌套聚合,但遇到了两个问题:
aggs = {
"account": {
"terms": {
"field": "to.keyword",
"order": { "amount": "desc"},
"size": 100,
"min_doc_count": 20,
},
"aggs": {
"total_amount": {
"nested": {
"path": "balance_diffs"
},
"aggs": {
"amount": {
"sum": {
"field": "balance_diffs.diff_balance_usd"
},
},
"accounts_bucket_sort": {
"bucket_sort": {
"sort": [
{ "amount.value": { "order": "desc" } }
],
}
}
}
},
}
}
}
1-“total_amount”不能在订单语句的顶层访问
2-neg_amount_filter”创建“搜索阶段执行异常”异常
如果我去掉这两部分,agg可以工作,但是我不能对结果进行过滤和排序。
我还尝试了另一篇文章中描述的reverse_nested和“multi_bucket_emulation”,但仍然出现“search_phase_execution_exception”错误
aggs = {
"contract": {
"terms": {
"field": "to.keyword",
"size": 100,
"min_doc_count": 20,
},
"aggs": {
"total_profit": {
"nested": {
"path": "balance_diffs"
},
"aggs": {
"profit": {
"sum": {
"field": "balance_diffs.diff_balance_usd"
},
},
"back_to_parent": {
"reverse_nested": {},
"aggs": {
"multi_bucket_emulator": {
"filters": {
"filters": {
"placeholder_match_all_query": {
"match_all": {}
}
}
},
"aggs": {
"contracts_bucket_sort": {
"bucket_sort": {
"sort": [
{ "profit": { "order": "desc" } }
],
}
}
}
},
}
}
}
},
}
}
}
1条答案
按热度按时间wixjitnu1#
您可以按嵌套子聚合对术语聚合进行排序。为了进行排序,您需要提供完整路径“total_amount〉amount”而不是“amount”。