In the scenario where low-cardinality and high-cardinality fields are mixed, assume that the following query statement exists:
POST testindex/_search
{
"size": 0,
"aggs": {
"groupby_region": {
"terms": {
"field": "region"
},
"aggs": {
"groupby_host": {
"terms": {
"field": "host"
},
"aggs": {
"groupby_timestamp": {
"date_histogram": {
"field": "timestamp",
"interval": "day"
},
"aggs": {
"avg_score": {
"avg": {
"field": "score"
}
}
}
}
}
}
}
}
}
}
Group the low-cardinality fields and create a histogram using the high-cardinality fields. To use the enhanced aggregation for the preceding query, set the parameters as follows:
- A clustering key is the prefix subset of a sorting key.
- High-cardinality fields must be in the sorting key, and high-cardinality fields must follow the last low-cardinality field.
// Configure an index
"settings" : {
"index" : {
"search" : {
"turbo" : {
"enabled" : "true" // Enable optimization
}
},
"sort" : { // Specify a sorting key
"field" : [
"region",
"host",
"timestamp",
"other"
]
},
"cluster" : {
"field" : [ // Specify a clustering key
"region",
"host"
]
}
}
}