# Tsvb - Sort by bucket script's value?

**URL:** <https://discuss.elastic.co/t/tsvb-sort-by-bucket-scripts-value/214073>\
**Category:** Kibana\
**Created:** [January 7, 2020, 2:28pm UTC](https://discuss.elastic.co/t/tsvb-sort-by-bucket-scripts-value/214073 "2020-01-07T14:28:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Skeeve](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@Skeeve](https://discuss.elastic.co/u/Skeeve)\
**Post date:** [January 7, 2020, 2:28pm UTC](https://discuss.elastic.co/t/tsvb-sort-by-bucket-scripts-value/214073/1 "2020-01-07T14:28:28Z")

</div>

My data contains informat about several companies sending mail. Each document contains

company name (tenant\_name)  
sending domain  
total amount of mails sent (total\_volume)  
amount of mails considered spam (spam\_complaints)

```
PUT /myindex
POST _bulk
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_a", "domain": "domain_1", "total_volume": 33, "spam_complaints": 10 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_a", "domain": "domain_2", "total_volume": 33, "spam_complaints": 5 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_a", "domain": "domain_3", "total_volume": 34, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_b", "domain": "domain_2", "total_volume": 333, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_b", "domain": "domain_3", "total_volume": 333, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_b", "domain": "domain_4", "total_volume": 334, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_c", "domain": "domain_3", "total_volume": 3, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_c", "domain": "domain_4", "total_volume": 3, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_c", "domain": "domain_1", "total_volume": 4, "spam_complaints": 2 }

```

What I like to get is the percentage of spam per company over the time. I already solved that using tsvb.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/47ed2fa227bd23e65952cbfc91eb52dc692f7f4f.png)

But when it comes to grouping (by term "tenant\_name") I can only order by total\_volume or spam\_complaints. Both is not sufficient as I would need to order by the percentage of spam\_complaints (so by spam\_complaints/total\_volume).

Looking at the data you can see that each metric (total\_volume, spam\_complaints, percentage) would give a different order:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b47b16fdabda9f932a424c12c6333ab93577459c.jpeg)

I currently see no way how to achieve the ordering by percentage, in this case so that company\_c would be top.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [January 9, 2020, 8:19pm UTC](https://discuss.elastic.co/t/tsvb-sort-by-bucket-scripts-value/214073/2 "2020-01-09T20:19:53Z")

</div>

Elasticsearch is not able to sort buckets of pipeline aggregations, which is why TSVB doesn't give you that option.

Related: [https://github.com/elastic/kibana/issues/12178](https://github.com/elastic/kibana/issues/12178)

---

<div class="post-metadata">

**Author:** ![Skeeve](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@Skeeve](https://discuss.elastic.co/u/Skeeve)\
**Post date:** [January 10, 2020, 6:37am UTC](https://discuss.elastic.co/t/tsvb-sort-by-bucket-scripts-value/214073/3 "2020-01-10T06:37:06Z")

</div>

Thanks Tim.  
Is there another way I could achieve the result I like? Meaning: Get an overview of every company's spam-quota per day where I only see the top n with the highest quota?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2020, 6:37am UTC](https://discuss.elastic.co/t/tsvb-sort-by-bucket-scripts-value/214073/4 "2020-02-07T06:37:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.