Custom Bucket Sub Aggregations and Top Hits

[csepulv]

I would like to a custom aggregation that either doesn't use geohash'ing or uses geohash as a sub-aggregation.

Imagine you are mapping schools or fast food restaurants. I'd like to aggregate by the school type (elementary, middle school, etc.) or restaurant chain name first, then map the metric of count, average, etc. In this case geohash, as a sub aggregation, is fine. (Basically, I have some term/identifier I'd like to use as first level aggregation.)

But I would also like to show the first or last school/restaurant opening, in which case I'd like a top_hits sub-aggregation and not use the geohash (or, in some cases use top_hits with the geohash).

To be more specific, if I have a position geopoint, the resulting aggregation the exising map visualization gets is:

"aggs": {
              "2": {
                "geohash_grid": {
                  "field": "position",
                  "precision": 3
                },
                "aggs": {
                  "3": {
                    "geo_centroid": {
                      "field": "position"
                    }
                  }
                }
              }
            }

But assume I want a breakdown by brand (as in my earlier noted example), I would like the following aggregation/buckets:

"aggs": {
          "brand": {
            "terms": {
              "field": "brand_name"
            },
            "aggs": {
              "2": {
                "geohash_grid": {
                  "field": "position",
                  "precision": 3
                },
                "aggs": {
                  "3": {
                    "geo_centroid": {
                      "field": "position"
                    }
                  }
                }
              }
            }
          }
        }

I'd like more control over the aggregations and sub aggregations.

Thanks

[timroes]

Is it correct, that you are talking about configuration options for the region or coordinate/tile map?

[csepulv]

Coordinate Map

[nreese]

@csepulv

Top hits has been implemented in Maps application, https://www.elastic.co/guide/en/kibana/current/maps-top-hits-aggregation.html, and produces requests like

"aggs": {
    "entitySplit": {
      "terms": {
        "size": 10000,
        "shard_size": 10000,
        "field": "machine.os.keyword"
      },
      "aggs": {
        "entityHits": {
          "top_hits": {
            "size": 1,
            "script_fields": {},
            "docvalue_fields": [
              "geo.coordinates"
            ],
            "_source": false
          }
        }
      }
    }

For you other request about nesting geotile_grid aggregation under terms aggregation, this will produce problems with hitting cluster setting search.max_buckets.

There is an open PR that implements the inverse of this, which is finding the top term per geotile_grid. Would a solution like this work for your use case?

[csepulv]

It is good to hear that Maps has added top hits. (Thanks)

I think the PR you mentioned might work for the use case I noted. I am not sure, as we had to move away from the Kibana map plugin.

It might make sense to close this issue at this point.

[nreese]

closed by:
top hits: #38052
top term: #57875