Custom aggregator logic when gathering data from multiple indexes

Elastic Stack Elasticsearch
1

Hi!,

I'm doing a "terms aggregation" + "top-bucket" subaggregation on each bucket. And I have several indexes: index1, index2, index3, index4 etc.

And I want to get x=20 "buckets" on the top aggregation.

Can I(how?) modify the aggregation functioning, so I can do:

aggregate on index1
if buckets < 20:
    aggregate on index2 + merge
if buckets <20:
    aggregate on index3 + merge
if buckets < 20:
    aggregate on index4 + merge
etc

I understand I can do this on the client, with custom merging logic, but maybe it's faster/better/possible? to do it in the server ?

Thank You

2

You may be able to do this with a scripted agg, but it's not going to amazingly fast.