有没有办法通过'order'字段对百分位聚合进行排序是Elasticsearch？

Question

我正在尝试通过order 字段对百分位数的子聚合进行排序（当我在 avg/sum 聚合上运行它时它可以工作）

{
  "size": 0,
  "_source": false,
  "stored_fields": "_none_",
  "aggregations": {
    "aggs": {
      "terms": {
        "field": "field",
        "size": 100,
        "min_doc_count": 1,
        "shard_min_doc_count": 0,
        "show_term_doc_count_error": false,
        "order": [
          {
            "sub_aggs": "asc"
          },
          {
            "_key": "asc"
          }
        ]
      },
      "aggregations": {
        "sub_aggs": {
          "percentiles": {
            "field": "sub_agg_field",
            "percents": [95],
            "keyed": true,
            "tdigest": {
              "compression": 100
            }
          }
        }
      }
    }
  }
}

但是当我运行它时，我得到了下一个错误：

{
  "error": {
    "root_cause": [
      {
        "type": "aggregation_execution_exception",
        "reason": "Invalid aggregation order path [sub_aggs]. When ordering on a multi-value metrics aggregation a metric name must be specified"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "some_index",
        "node": "xJIpW6KTSMuL41-zu9um-w",
        "reason": {
          "type": "aggregation_execution_exception",
          "reason": "Invalid aggregation order path [sub_aggs]. When ordering on a multi-value metrics aggregation a metric name must be specified"
        }
      }
    ]
  },
  "status": 500
}

问题是我如何在多值聚合中做到这一点（如果它在单聚合中不起作用）？

Answer 1

该文档包含有关如何按多值聚合https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-order 进行排序的指南

按多值指标子聚合（由聚合名称标识）对存储桶进行排序：

GET /_search
{
  "aggs": {
    "genres": {
      "terms": {
        "field": "genre",
        "order": { "playback_stats.max": "desc" }
      },
      "aggs": {
        "playback_stats": { "stats": { "field": "play_count" } }
      }
    }
  }
}

所以也许这会起作用？

{
  "size": 0,
  "_source": false,
  "stored_fields": "_none_",
  "aggregations": {
    "aggs": {
      "terms": {
        "field": "field",
        "size": 100,
        "min_doc_count": 1,
        "shard_min_doc_count": 0,
        "show_term_doc_count_error": false,
        "order": [
          {
            "sub_aggs.95": "asc"
          },
          {
            "_key": "asc"
          }
        ]
      },
      "aggregations": {
        "sub_aggs": {
          "percentiles": {
            "field": "sub_agg_field",
            "percents": [95],
            "keyed": true,
            "tdigest": {
              "compression": 100
            }
          }
        }
      }
    }
  }
}