Get Max Aggregate value for top N hits from elasticsearch

Elastic Stack Logstash
1

Hey guys,
I have an Elasticsearch field called activity_time, and I need to get the maximum activity_time from a subset of my data. For Ex, I want to get the max value of activity_time from the first 100 records when sorted in ascending order by activity_time.
I am aware of the max aggregation query,

{
.....
  "max_activity_time":{
     "max":{
          "field":"activity_time"
      }
  }
}

However, I'm struggling to limit this to only the first 100 records. I read up about sampler aggregation but cannot seem to make it work, any assistance would be greatly appreciated.

2

Thanks, @Het_Test. Do you have an example of some queries that haven't worked? I would expect something like this to work for you here:

{
  "size": 0,
  "aggs": {
    "sample": {
      "sampler": {
        "shard_size": 100
      },
      "aggs": {
        "max_activity_time": {
          "max": {
            "field": "activity_time"
          }
        }
      }
    }
  }
}
3

Hey,
I was using the following example as reference,

https://stackoverflow.com/questions/28896043/limit-elasticsearch-aggregation-to-top-n-query-results/35971531#35971531

I tried the solution you provided but it does not seem to get the top 100 in ascending order of activity time, would it be possible to do so?

4

Thanks for following up, @Het_Test. That may be because the sampler returns a random subset from the dataset. What about a multi-step query such as this one?

{
  "size": 0,
  "aggs": {
    "top_hits_sample": {
      "top_hits": {
        "size": 100,
        "sort": [
          {
            "activity_time": {
              "order": "asc"
            }
          }
        ]
      }
    },
    "max_activity_time_from_sample": {
      "max_bucket": {
        "buckets_path": "top_hits_sample>max_activity_time"
      }
    },
    "aggs": {
      "max_activity_time": {
        "max": {
          "field": "activity_time"
        }
      }
    }
  }
}