Elasticsearch sort by field

Elastic Stack Elasticsearch
1

I need to perform a sort by “status" (field in data set) operation on elastic search data where value of status is mapped.

Example : This is sample data in elastic search

{

"tickets": [    
    {
        "ticketId": "805",
        "accountId": "676",
        "subject": "changed the subject line, let's see how long it takes",
        "status": “New",          
    },
    {
        "ticketId": "207",
        "accountId": "324",
        "subject": "Set to Pending Vendor",
        "status": “Progress",          
    },
    {
        "ticketId": "208",
        "accountId": "714",
        "subject": "Set to Pending Maintenance",
        "status": “Process",         
    },
    {
        "ticketId": "005",
        "accountId": "376",
        "subject": "status test ticket",
        "status": “Progress",            
    },
    {
        "ticketId": "004",
        "accountId": "676",
        "subject": "status test ticket",
        "status": “Process",           
    },
    {
        "ticketId": "153",
        "accountId": "376",
        "subject": "the subject",
        "status": “Solved",          
    },
    {
        "ticketId": "379",
        "accountId": “676",
        "subject": "the subject",
        "status": “Progress",            
    },
    {
        "ticketId": "871",
        "accountId": “676",
        "subject": "the subject",
        "status": “Closed",            
    },
    {
       "ticketId": "153",
        "accountId": “876",
        "subject": "the subject",
        "status": “New",         
    },
    {
        "ticketId": "008",
        "accountId": “756",
        "subject": "Request to Enable AlertLogic ThreatManager for Internal Vulnerability Scans",
        "status": “Progress",          
    },
    {
        "ticketId": "184",
        "accountId": "236",
        "subject": "the subject",
        "status": “Solved",           
    },
    {
        "ticketId": "018",
       "accountId": "368",
        "subject": "the subject",
        "status": “Closed",        
    },
    {
        "ticketId": "708",
        "accountId": “456",
        "subject": "Ticket v2 Test",
        "status": “Solved",           
    },
    {
        "ticketId": "382",
        "accountId": “824",
        "subject": "the subject",
        "status": “Process",         
    },
    {
        "ticketId": "013",
        "accountId": “576",
        "subject": "the subject",
        "status": “Solved",            
    },
    {
        "ticketId": "002",
        "accountId": "676",
        "subject": "SDP QE Ticket",
        "status": “Progress",            
    },
    {
        "ticketId": "005",
        "accountId": "236",
        "subject": "SDP QE Ticket",
        "status": “New",            
    },
    {
       "ticketId": "298"
        "accountId": “986",
        "subject": "the subject",
        "status": “Closed",           
    }
]

}

status has to be mapped in following manner

New, Progress, Process -> Pending
Solved -> Resolved
Closed -> Removed

So, expected sequence of results from elastic search (as per mapping sequence )

{
"tickets": [
{
"ticketId": "805",
"accountId": "676",
"subject": "changed the subject line, let's see how long it takes",
"status": “New",
},
{
"ticketId": "207",
"accountId": "324",
"subject": "Set to Pending Vendor",
"status": “Progress",
},
{
"ticketId": "208",
"accountId": "714",
"subject": "Set to Pending Maintenance",
"status": “Process",
},
{
"ticketId": "005",
"accountId": "376",
"subject": "status test ticket",
"status": “Progress",
},
{
"ticketId": "004",
"accountId": "676",
"subject": "status test ticket",
"status": “Process",
},
{
"ticketId": "379",
"accountId": “676",
"subject": "the subject",
"status": “Progress",
},
{
"ticketId": "153",
"accountId": “876",
"subject": "the subject",
"status": “New",
},
{
"ticketId": "008",
"accountId": “756",
"subject": "Request to Enable AlertLogic ThreatManager for Internal Vulnerability Scans",
"status": “ Progress",
},
{
"ticketId": "002",
"accountId": "676",
"subject": "SDP QE Ticket",
"status": “Progress",
},
{
"ticketId": "005",
"accountId": "236",
"subject": "SDP QE Ticket",
"status": “New",
},
{
"ticketId": "382",
"accountId": “824",
"subject": "the subject",
"status": “Process",
},
{
"ticketId": "871",
"accountId": “676",
"subject": "the subject",
"status": “Closed",
},
{
"ticketId": "018",
"accountId": "368",
"subject": "the subject",
"status": “Closed",
},
{
"ticketId": "298",
"accountId": “986",
"subject": "the subject",
"status": “Closed",
},
{
"ticketId": "184",
"accountId": "236",
"subject": "the subject",
"status": “Solved",
},
{
"ticketId": "708",
"accountId": “456",
"subject": "Ticket v2 Test",
"status": “Solved",
},
{
"ticketId": "013",
"accountId": “576",
"subject": "the subject",
"status": “Solved",
},
{
"ticketId": "153",
"accountId": "376",
"subject": "the subject",
"status": “Solved",
},
]
}

How this functionality can be implemented using elastic search query. Is it possible to perform by using function_score ?

2

Is you intention to return new values "pending", "resolved", "removed" in the search result? Or do you want to modify documents to have these new values?
If it is for search, you can take advantage of script fields.

An example, how script fields can be used for your use-case:

GET /_search
{
  "query" : {
      "match_all": {}
  },
  "script_fields" : {
      "updated-status" : {
          "script" : {
              "lang": "painless",
              "source": "if (doc['status'].value == 'New') {'Pending';} else {'Resolved';}"
          }
      }
  }
}
3

Thanks for help

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.