弹性搜索：根据3个字段的总和获得最佳结果

Question

这是我的 QueryDSL ，根据字段 count1

的总和，按降序返回前30个结果

 {
  "query": {
    "bool": {
      "must": [],
      "filter": {
        "range": {
          "@timestamp": {
            "gte": "2017/08/01",
            "lte": "2017/08/31",
            "format": "yyyy/MM/dd||yyyy||yyyy"
          }
        }
      },
      "filter": {
        "range": {
          "count1": {
            "gt": 0
          }
        }
      }
    }
  },
  "size": 0,
  "aggs": {
    "ch_agg": {
      "terms": {
        "field": "ChID",
        "size": 30,
        "order": {
          "sum_agg": "desc"
        }
      },
      "aggs": {
        "sum_agg": {
          "sum": {
            "field": "count1"
          }
        }
      }
    }
  }
}

现在我有2个其他字段 count2 ＆amp; count3 也是。如何修改此查询，以便根据 count1 + count2 + {{1}的总和返回前30个文档}}

Answer 1

尝试将Top-Hits聚合添加为嵌套聚合

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-top-hits-aggregation.html