Tldr;

可以在聚合中使用order对数据进行排序。
根据此处的文档
在这种情况下，存储桶按实际术语值排序，如关键字按字典顺序排序或数字按数字顺序排序。这种排序在升序和降序方向上都是安全的，并且生成准确的结果。

溶液

GET /74006495/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "timestamp": {
              "gte": "2022-05-06T16:35:42"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "search_terms": {
      "terms": {
        "field": "search_term.keyword",
        "size": 10,
        "order": { "count": "desc" } // <- Here is the order by count agg
      },
      "aggs": {
        "count": {
          "sum": {
            "field": "counter"
          }
        }
      }
    }
  }
}

我使用了一个按日期过滤器，然后将结果聚集。

{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "timestamp": {
              "gte": "2022-05-06T16:35:42"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "search_by_day": {
      "date_histogram": {
        "field": "timestamp",
        "calendar_interval": "day"
      },
      "aggs": {
        "search_term": {
          "terms": {
            "field": "search_term.keyword",
            "size": 10
          },
          "aggs": {
            "total_counter": {
              "sum": {
                "field": "counter"
              }
            },
            "counter_bucket_sort": {
              "bucket_sort": {
                "sort": [
                  {
                    "total_counter": {
                      "order": "desc"
                    }
                  }
                ],
                "size": 3
              }
            }
          }
        }
      }
    }
  }
}

结果：

"aggregations": {
    "search_by_day": {
      "buckets": [
        {
          "key_as_string": "2022-05-06T00:00:00.000Z",
          "key": 1651795200000,
          "doc_count": 4,
          "search_term": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "hello",
                "doc_count": 2,
                "total_counter": {
                  "value": 19
                }
              },
              {
                "key": "bye",
                "doc_count": 2,
                "total_counter": {
                  "value": 12
                }
              }
            ]
          }
        }
      ]
    }
  }