弹性搜索中聚集的排序结果

Question

I have written a query to get the latest records per Id from my ES. But the result of this query only does the inner sorting and chooses the latest records. Now I need the results that I got to be sorted by date.

This is my query:

{
   "size":0,
   "query":{
      "bool":{
         "must":[
            {
               "match":{
                  "base":"XYZ"
               }
            },
            {
               "match":{
                  "Type":"low"
               }
            }
         ]
      }
   },
   "aggs":{
      "sources":{
         "terms":{
            "field":"Id"
         },
         "aggs":{
            "latest":{
               "top_hits":{
                  "size":1,

                  "_source":{
                     "includes":[
                        "base",
                        "Type"
                     ]
                  },
                  "sort":{
                     "orderDate":"desc"
                  }
               }
            }
         }
      }
   }
}

Answer 1

What you are trying to do is sorting the buckets by another another bucket. You can achieve this in two ways:

(a) By bucket_sort aggregation

(b) by using order param for terms aggregation referencing to another bucket.

(a) bucket_sort aggregation

This aggregation sorts the buckets of its parent multi-bucket aggregation. You can specify the field(s) based on which the buckets will be sorted. Using this, the query for your case will be:

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "base": "XYZ"
          }
        },
        {
          "match": {
            "Type": "low"
          }
        }
      ]
    }
  },
  "aggs": {
    "source": {
      "terms": {
        "field": "id"
      },
      "aggs": {
        "latest": {
          "top_hits": {
            "size": 1,
            "_source": {
              "includes": [
                "base",
                "Type"
              ]
            },
            "sort": {
              "orderDate": "desc"
            }
          }
        },
        "latestOrder": {
          "max": {
            "field": "orderDate"
          }
        },
        "bucket_sort_order": {
          "bucket_sort": {
            "sort": {
              "latestOrder": {
                "order": "desc"
              }
            }
          }
        }
      }
    }
  },
  "post_filter": {
    "term": {
      "status": "yes"
    }
  }
}

In the query above I have used a max aggregation named as latestOrder . This aggregation gives us the value for latest orderDate . If we look as the top hit aggregation the document returned by it will have the same orderDate as returned by the max aggeration ie latestOrder . The reason being we have ordered top hit by orderDate in desc and limited the size to one, which is equivalent to max orderDate .

latestOrder works as a sorting field for us which is then used in the bucket_sort aggregation to sort the parent buckets which are the buckets returned by terms aggregation.

(b) order param in terms agg

We use the similar approach as above. We use max aggregation latestOrder and reference it in order param of terms aggregation. So the query will be:

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "base": "XYZ"
          }
        },
        {
          "match": {
            "Type": "low"
          }
        }
      ]
    }
  },
  "aggs": {
    "source": {
      "terms": {
        "field": "id",
        "order": {
          "latestOrder": "desc"
        }
      },
      "aggs": {
        "latest": {
          "top_hits": {
            "size": 1,
            "_source": {
              "includes": [
                "base",
                "Type",
                "orderDate"
              ]
            },
            "sort": {
              "orderDate": "desc"
            }
          }
        },
        "latestOrder": {
          "max": {
            "field":"orderDate"
          }
        }
      }
    }
  },
  "post_filter": {
    "term": {
      "status": "yes"
    }
  }
}

UPDATE in queries : Based on discussion in comments added post_filter.