Elasticsearch Aggregations: Only return results of one of them?

Question

I'm trying to find a way to only return the results of one aggregation in an Elasticsearch query. I have a max bucket aggregation (the one that I want to see) that is calculated from a sum bucket aggregation based on a date histogram aggregation. Right now, I have to go through 1,440 results to get to the one I want to see. I've already removed the results of the base query with the size: 0 modifier, but is there a way to do something similar with the aggregations as well? I've tried slipping the same thing into a few places with no luck.

Here's the query:

{
    "size": 0,
    "query": {
        "range": {
            "timestamp": {
                "gte": "2018-11-28",
                "lte": "2018-11-28"
            }
        }
    },
    "aggs": {
        "hits_per_minute": {
            "date_histogram": {
                "field": "timestamp",
                "interval": "minute"
            },
            "aggs": {
                "total_hits": {
                    "sum": {
                        "field": "hits_count"
                    }
                }
            }
        },
        "max_transactions_per_minute": {
            "max_bucket": {
                "buckets_path": "hits_per_minute>total_hits"
            }
        }
    }
}

Answer 1

幸运的是，您可以使用在 Elasticsearch 6.4 中添加的bucket_sort聚合来做到这一点。

用它做 bucket_sort

POST my_index/doc/_search
{
  "size": 0,
  "query": {
    "range": {
      "timestamp": {
        "gte": "2018-11-28",
        "lte": "2018-11-28"
      }
    }
  },
  "aggs": {
    "hits_per_minute": {
      "date_histogram": {
        "field": "timestamp",
        "interval": "minute"
      },
      "aggs": {
        "total_hits": {
          "sum": {
            "field": "hits_count"
          }
        },
        "max_transactions_per_minute": {
          "bucket_sort": {
            "sort": [
              {"total_hits": {"order": "desc"}}
            ],
            "size": 1
          }
        }
      }
    }
  }
}

这会给你这样的回应：

{
  ...
  "aggregations": {
    "hits_per_minute": {
      "buckets": [
        {
          "key_as_string": "2018-11-28T21:10:00.000Z",
          "key": 1543957800000,
          "doc_count": 3,
          "total_hits": {
            "value": 11
          }
        }
      ]
    }
  }
}

请注意，输出中没有额外的聚合，并且 的输出hits_per_minute被截断（因为我们要求只给出一个最顶层的桶）。

用它做 filter_path

还有一种通用的方法来过滤 Elasticsearch 的输出：响应过滤，正如这个答案所暗示的那样。

在这种情况下，只需执行以下查询就足够了：

POST my_index/doc/_search?filter_path=aggregations.max_transactions_per_minute
{ ... (original query) ... }

这将给出响应：

{
  "aggregations": {
    "max_transactions_per_minute": {
      "value": 11,
      "keys": [
        "2018-12-04T21:10:00.000Z"
      ]
    }
  }
}