ElasticSearch Aggregation Group按子条款排序字段文档数

Question

My mapping model:

// TypeLog: Error, Info, Warn

{
   "onef-sora": {
      "mappings": {
         "Log": {
            "properties": {

               "application": {
                  "type": "string",
                  "index": "not_analyzed"
               }
               "typeLog": {
                  "type": "string"
               }
            }
         }
      }
   }
}

My query:

{
  "size": 0,
  "aggs": {
    "application": {
      "terms": {
        "field": "application",
        "order" : { "_count" : "desc"},
        "size": 5
      },
      "aggs": {
        "typelogs": {
          "terms": {
            "field": "typeLog",
            "order" : { "_term" : "asc"}
          }
        }
      }
    }
  }
}

I want get top 5 application has most error, but term aggregation order support three key : _count, _term, _key. How do I order by typeLog doc_count in my query. Thanks !!!

Result I want:

 {
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 10000,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "application": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 5000,
         "buckets": [
            {
               "key": "OneF0",
               "doc_count": 1000,
               "typelogs": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "error",
                        "doc_count": 334
                     },
                     {
                        "key": "info",
                        "doc_count": 333
                     },
                     {
                        "key": "warn",
                        "doc_count": 333
                     }
                  ]
               }
            },
            {
               "key": "OneF1",
               "doc_count": 1000,
               "typelogs": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "error",
                        "doc_count": 333
                     },
                     {
                        "key": "info",
                        "doc_count": 334
                     },
                     {
                        "key": "warn",
                        "doc_count": 333
                     }
                  ]
               }
            },
            {
               "key": "OneF2",
               "doc_count": 1000,
               "typelogs": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "error",
                        "doc_count": 332
                     },
                     {
                        "key": "info",
                        "doc_count": 333
                     },
                     {
                        "key": "warn",
                        "doc_count": 334
                     }
                  ]
               }
            }

         ]
      }
   }
}

Answer 1

As you to get the top 5 applications with most errors, you can filter to keep only error logs in query (you could use a filter). Then you only need order you sub-term aggregation by descending count

{
  "size": 0,
  "query": {
    "term": {
      "typeLog": "Error"
    }
  },
  "aggs": {
    "application": {
      "terms": {
        "field": "application",
        "order": {
          "_count": "desc"
        },
        "size": 5
      },
      "aggs": {
        "typelogs": {
          "terms": {
            "field": "typeLog",
            "order": {
              "_count": "desc"
            }
          }
        }
      }
    }
  }
}

To keep all typeLogs, you may need to perform your query the other way

{
  "size": 0,
  "aggs": {
    "typelogs": {
      "terms": {
        "field": "typeLog",
        "order": {
          "_count": "asc"
        }
      },
      "aggs": {
        "application": {
          "terms": {
            "field": "application",
            "order": {
              "_count": "desc"
            },
            "size": 5
          }
        }
      }
    }
  }
}

You will have 3 first level buckets, the the top 5 applications by type of log