Support Top Hits Aggregation for Elasticsearch

[parsa-saadatpanah]

What would you like to be added:

Enable top_hits aggregation in the Elasticsearch queries

Why is this needed:

Currently, there is no way to retrieve the string fields as a metric. Most of the metrics only work for numeric fields. Top_hits will enable working with string fields.

[marefr]

Here's the docs: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-top-hits-aggregation.html

[andreperegrina]

Any news about this?

[jehutywong]

+1 for this. I'd want the top_hit aggregation to get the latest document. Is there any other option?

[scroodj]

+1

[fkellner]

+1.

Use case:
I have several process logs in the same index and would like to show the last logged state (plus ideally some aggregations) per process.

I have tried some alternatives, which do not work for me (but might be of inspiration to others arriving here):

• I could use a stat panel and repeat it. But I cannot influence the order in which they are repeated, and would like the problematic processes to be listed top. Also, it is somewhat awkward to have to generate a variable first, and then setting the default value to all values, etc...
• The "Group By"-Transformation basically does what I need, but since Elasticsearch only delivers 10000 raw documents and there are about 20000 events logged per day, its practical usefulness is limited. (and don't tell me to simply use 2 queries, since I cannot set a time range per query or combine data from two other panels since this also does not work).

[AlfHou]

+1

I need this for the same use case as @fkellner

[JohnnyBee2]

+1

[ldaugusto]

+1

[fkellner]

The top metrics aggregation is an X-Pack feature that is not available to elasticsearch users using the free license or the OSS version (as opposed to the top hits aggregation that was mentioned in the feature request). I left the job for which I commented the use case, but whoever is following in my footsteps will probably not be able to use the top metrics aggregation, too.

[gelicia]

Hello, as you may have heard, we are transitioning away from using discussions to discuss feature requests. We are migrating this discussion to an issue and closing the discussion. The issue is #82963. Feel free to continue the discussion around this there. Thank you!