sorting - 聚合 Elasticsearch 中存储桶的字符串排序

Question

我想按具有字符串值的字段对结果进行排序，例如，我已经这样回答

"aggregations": {
    "group_agg": {
        "doc_count_error_upper_bound": -1,
        "sum_other_doc_count": 82,
        "buckets": [
            {
                "key": "38:16:33:6A:71:FF",
                "doc_count": 1,
                "group_agg_top_hit": {
                    "hits": {
                        "total": 1,
                        "max_score": null,
                        "hits": [
                            {
                                "_index": "23432534534",
                                "_type": "log",
                                "_id": "123143435346",
                                "_score": null,
                                "_source": {
                                    "name1": "aaa-bbb",
                                    "name2": "asdasd-bbb",
                                    "Mac": "38:22:33:6A:71:FF",
                                    "description": "",
                                    "event_timestamp": "2017-12-16T08:06:10.000+0000",
                                    "ssid": "aaa-network"
                                },
                                "sort": [
                                    1513411570000
                                ]
                            }
                        ]
                    }
                },
                "order_agg": {
                    "value": 1513411570000,
                    "value_as_string": "2017-12-16T08:06:10.000Z"
                }
            }
        ]
    }
}

我用time_stamp将其soret了，这是一个数值，我需要对结果进行排序

=====================================

 "aggs": {
"group_agg": {
  "terms": {
    "field": "Mac.rawData",
    "size": 1,
     "order" : { "order_agg" : "asc" }   ----> need to change this to make sorting by name 1 or name 2

  },
  "aggs": {
    "order_agg": {
      "max": {
        "field": "event_timestamp"
      }
    },
    "group_agg_top_hit": {
      "top_hits": {
      "sort": [
                {
                    "event_timestamp": {
                        "order": "desc"
                    }
                }
            ],
            "_source": {
                "includes": ["name1", "name2", "Mac", "ssid", "event_timestamp","description"]
            },
        "size": 1
      }
    }
  }
}

}

====
此代码有效，但我需要将存储桶排序更改为按名称而不是event_timestamp

请帮忙

Answer 1

如果您使用的是ES版本> 6.x，则可以使用“复合聚合”。它接受文本搜索，但工作原理与TermAggregation略有不同:

https://www.elastic.co/guide/en/elasticsearch/reference/6.7/search-aggregations-bucket-composite-aggregation.html