[FIXED] How to sort the values based upon aggregate data in Elastic Search

Issue

PUT my-data-stream/_bulk
{"create":{}}
{"timestamp":"2022-05-06T18:25:42","search_term":"hello", "counter": 10}
{"create":{}}
{"timestamp":"2022-05-06T18:25:42","search_term":"bye", "counter": 5}
{"create":{}}
{"timestamp":"2022-05-06T17:25:42","search_term":"hello", "counter": 9}
{"create":{}}
{"timestamp":"2022-05-06T17:25:42","search_term":"bye", "counter": 7}
{"create":{}}
{"timestamp":"2022-05-06T16:25:42","search_term":"hello", "counter": 5}
{"create":{}}
{"timestamp":"2022-05-06T16:25:42","search_term":"bye", "counter": 2}

Given the data set above. I want to sort (DESC) the search terms by sum of the counters which are greater than a specific timestamp.

For example: For timestamp greater than 2022-05-06T16:35:42 (which are top 4 records). Result should be

 Hello, 19 (10 + 9)
 Bye, 12 (5 + 7)

Solution

Tldr;

You can order your data using order in you aggregation.

As per the documentation here

In this case, the buckets are ordered by the actual term values, such as lexicographic order for keywords or numerically for numbers. This sorting is safe in both ascending and descending directions, and produces accurate results.

Solution

GET /74006495/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "timestamp": {
              "gte": "2022-05-06T16:35:42"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "search_terms": {
      "terms": {
        "field": "search_term.keyword",
        "size": 10,
        "order": { "count": "desc" } // <- Here is the order by count agg
      },
      "aggs": {
        "count": {
          "sum": {
            "field": "counter"
          }
        }
      }
    }
  }
}

Answered By - Paulo

Answer Checked By - Dawn Plyler (PHPFixing Volunteer)