Buckets_path to access field in top_hits aggregation result

Elastic Stack Elasticsearch
1

Is it possible to use a pipeline aggregation to access information contained in the result of a top_hits aggregation? If so, what's the correct buckets_path to use?

Here's an illustrative example.

POST testcalc1/test1/_bulk
{"index" : {} }
{"counter" : 1, "number" : 1}
{"index" : {} }
{"counter" : 2, "number" : 2}
{"index" : {} }
{"counter" : 3, "number" : 3}
{"index" : {} }
{"counter" : 4, "number" : 4}
{"index" : {} }
{"counter" : 5}
{"index" : {} }
{"counter" : 6}
{"index" : {} }
{"counter" : 7, "number" : 7}
{"index" : {} }
{"counter" : 8, "number" : 8}
{"index" : {} }
{"counter" : 9}
{"index" : {} }
{"counter" : 10, "number" : 10}

POST testcalc1/test1/_search?filter_path=aggregations
{
  "size": 0,
  "aggs": {
    "buckets": {
      "histogram": {
        "field": "counter",
        "interval": 20
      },
      "aggs": {
        "top_hits_agg": {
          "top_hits": {
            "size": 1
          }
        }
      }
    }
  }
}

These data and simple aggregation (using only one trivial bucket to keep the result small, but same idea for proper histogram buckets) will give this result:

{
  "aggregations": {
    "buckets": {
      "buckets": [
        {
          "key": 0,
          "doc_count": 10,
          "top_hits_agg": {
            "hits": {
              "total": 10,
              "max_score": 1,
              "hits": [
                {
                  "_index": "testcalc1",
                  "_type": "test1",
                  "_id": "AVxHgAkzM60NS_VZXIZ-",
                  "_score": 1,
                  "_source": {
                    "counter": 2,
                    "number": 2
                  }
                }
              ]
            }
          }
        }
      ]
    }
  }
}

However, if I want to access number in the top_hits using bucket_script, the following two aggregations return errors.

POST testcalc1/test1/_search?filter_path=aggregations
{
  "size": 0,
  "aggs": {
    "buckets": {
      "histogram": {
        "field": "counter",
        "interval": 20
      },
      "aggs": {
        "top_hits_agg": {
          "top_hits": {
            "size": 1
          }
        },
        "want_info_from_top_hits" : {
          "bucket_script": {
            "buckets_path": {
              "top_hits_var" : "top_hits_agg"
            },
            "script": "params.top_hits_var[1].number"
          }
        }
      }
    }
  }
}

which gives

{
  "error": {
    "root_cause": [],
    "type": "search_phase_execution_exception",
    "reason": "",
    "phase": "fetch",
    "grouped": true,
    "failed_shards": [],
    "caused_by": {
      "type": "aggregation_execution_exception",
      "reason": "buckets_path must reference either a number value or a single value numeric metric aggregation, got: org.elasticsearch.search.aggregations.metrics.tophits.InternalTopHits"
    }
  },
  "status": 503
}

While this

POST testcalc1/test1/_search?filter_path=aggregations
{
  "size": 0,
  "aggs": {
    "buckets": {
      "histogram": {
        "field": "counter",
        "interval": 20
      },
      "aggs": {
        "top_hits_agg": {
          "top_hits": {
            "size": 1
          }
        },
        "want_info_from_top_hits" : {
          "bucket_script": {
            "buckets_path": {
              "top_hits_var" : "top_hits_agg.hits"
            },
            "script": "params.top_hits_var[1].number"
          }
        }
      }
    }
  }
}

returns this

{
  "error": {
    "root_cause": [],
    "type": "search_phase_execution_exception",
    "reason": "",
    "phase": "fetch",
    "grouped": true,
    "failed_shards": [],
    "caused_by": {
      "type": "illegal_argument_exception",
      "reason": "path not supported for [top_hits_agg]: [hits]"
    }
  },
  "status": 503
}

Other paths I've tried, such as top_hits_agg>hits and top_hits_agg.hits.hits[1], all fail with "reason": "No aggregation found for path ....

Any takers?

3 Likes
2

Would StackOverflow be a better place to ask this question? Or perhaps I should file an issue in Github?

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.