Skip to content

Add support for multi-field keys to terms aggs #65623

Closed
@imotov

Description

@imotov

There is a need in kibana (see elastic/kibana#77632) to dynamically form a key from multiple ordered fields, similar to composite aggs. The example that kibana team provided is to find top 10 cpu users, where each user is identified by a compound key consisting of datacenter id, host id, and container id. The required result is 3 keys and cpu usage metric with everything sorted by cpu usage descending:

datacenter host name container id cpu (sorted 🔽)
us-east-1 f80a10 b91e34 55.20
us-east-2 6dd558 493fb5 42.00
us-west-2 ba4d4 9675e5 40.73
us-west-1 60413e 0574ef 39.92
us-east-1 f80a10 b91e34 36.21
us-east-2 6dd558 47b9c81 34.58
us-west-1 ba4d4 9675e5 24.01
us-east-1 f80a10 b91e34 22.40
us-east-2 6dd558 493fb5 15.91
us-west-1 27380b f44031 12.33

The current solution is really awkward and limiting concatenation of fields using a script. We would like to offer a more streamlined solution for Kibana here.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions