All the keyword arguments to the DSL methods are typically just converted to keys in the resulting dict/json code, this means you can just add order={'_count': 'desc'} like so: s.aggs.bucket(‘per_user’, ‘terms’, field=‘event_data.TargetUserName’, size=100, order={'_count': 'desc'})
Note however that that sorting (descending by number of documents) is the default so you don't need to specify anything
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.