{
"error": {
"root_cause": [
{
"type": "aggregation_execution_exception",
"reason": "Invalid aggregator order path [data.hardware.ram_usage]. The provided aggregation [data.hardware] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets."
},
{
"type": "aggregation_execution_exception",
"reason": "Invalid aggregator order path [data.hardware.ram_usage]. The provided aggregation [data.hardware] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets."
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
My query is
{
"aggs": {
"2": {
"terms": {
"field": "agent.name",
"size": 5,
"order": {
"data.hardware.ram_usage": "desc"
}
},
"aggs": {
"3": {
"terms": {
"field": "data.hardware.ram_usage",
"size": 1,
"order": {
"_count": "desc"
}
}
}
}
}
},
"size": 0,
"_source": {
"excludes": [
"@timestamp"
]
},
"query": {
"bool": {
"must": [
{
"match_all": {}
},
{
"exists": {
"field": "data.hardware.ram_usage"
}
}
]
}
}
}
What i want to do is get 5 agent.name which have the largest data.hardware.ram_usage value.
Can someone help me with this?