Could this be a solution without composite aggregation?
how much optimal and right way it's for performance? is right "size": 1000000000?
{
"size": 0,
"aggs": {
"country_name": {
"terms": {
"field": "geoip.country_name.keyword",
"size": 1000000000
},
"aggs": {
"city_name": {
"terms": {
"field": "geoip.city_name.keyword",
"size": 1000000000
},
"aggs": {
"count": {
"value_count": {
"field": "geoip.city_name.keyword"
}
},
"count_bucket_filter": {
"bucket_selector": {
"buckets_path": {
"totalCount": "count"
},
"script": "params.totalCount > 2000"
}
},
"paging": {
"bucket_sort": {
"from": 0,
"size": 10
}
}
}
},
"paging": {
"bucket_sort": {
"from": 0,
"size": 10
}
}
}
}
}
}