Bucket Terms aggregation, top 20 values

Elastic Stack Kibana
1

Hi,
on my Buckets I have the Terms aggregation, with a field of the type number.
I need the 20 biggest values of that field - in ascending order.

  • Is it possible to order the Terms ascending and then take the last 20 values?
  • Or can order all entries of that field in descending order, to take the first 20 values, and order them again in ascending order?

Thanks in advance

2

You can get the 20 biggest values of a number by sorting the Terms aggregation in Descending Alphabetical order, but not in ascending order- that will get you the 20 smallest values because it's doing sorting inside Elasticsearch. It is possible to use column sorting in the Data Table visualization, which takes the results from Elasticsearch and re-sorts them.

1 Like
3

Does that mean, there is no chance to get that result in a line graph?

I would need the 20 highest values in ascending order.

4

That's right, the order of the data is what controls the order of the visualization for other chart types. Yesterday I opened an issue to track this as a feature request for Lens, which would also solve your use case. It also includes links to past requests: https://github.com/elastic/kibana/issues/86184

2 Likes
5

Thanks for reply,
are there the same limitations, if I create a Graph vom custom query?
Or is that kind of creation even possible?

6

Is it possible to invert that topic?
To display the latest value in a Bucket but not in a Metric?
display latest value in a metric

7

We do offer a fully custom visualization builder, you can follow my Vega tutorial to learn about how it works.

I don't think I understand your second question about "latest value in a bucket". You would need to be more specific about what your input data is and what you want the output data to be. I suggest that you open a new thread to explain your question more.

8

Thanks, I opened new thread of my use case. display-latest-value-in-a-bucket

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.