Filter on Aggregation Results

Elastic Stack Elasticsearch
1

Hello World,

I am currently facing the following challenge:

I want to :
1- Group data by center and sum over value1 (resulting in sum_value1)
2- Given ALL OF the output of step1 and some min and max values, filter sum_value1 to be in range of [min,max]
3- Sort the results of the filtering (step2) and take the top X results (desc or asc)

Document schema:
    {
    	center: keyword
    	value1: integer
    }

I have currently came up with the following query:

curl -XGET 'indexName/_search?pretty' -H 'Content-Type: application/json'  -d'
{
    "aggs" : {
        "center_terms" : {
            "terms" : {
                "field" : "center" ,
                "size": 1000            
                },
            "aggs": {
                "sum_value1": {
                    "sum": {
                        "field": "value1"
                    }
                },
                "sum_bucket_selector1": {
                    "bucket_selector": {
                        "buckets_path": {
                            "sumValue1": "sum_value1"
                            },
                        "script": "params.sumValue1 > 200"
                    }
                },
                "sum_bucket_selector2": {
                    "bucket_selector": {
                        "buckets_path": {
                            "sumValue1": "sumValue1"
                            },
                        "script": "params.sumValue1 < 1000"
                    }
                }
            }
        }
    }
}'

The problem that I am facing is that the filtering is only performed on the "size" buckets (in this case only 1000 buckets) and that misses a lot of "interesting" buckets. In particular, there are more buckets than any value of the size parameter.

In other words, what I really want is: to filter on ALL the buckets, then sort and return the top X results.

Can someone please help?

Thanks a lot!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.