Keyword support or alternative for top_metrics aggregation

[dgieselaar]

In APM, we use a top_hits aggregation in some places to get certain values for the UI. E.g., if we are aggregation over service.name, we also need agent.name or each value of service.name. A top_hits aggregation can be costly, especially when there are many buckets.

Recently top_metrics was introduced as a lighter, faster alternative to top_hits. However, it does not support keywords (yet).

We would benefit from having top_metrics support keywords or a different aggregation that does the same, but for keywords.

[elasticmachine]

Pinging @elastic/es-analytics-geo (:Analytics/Aggregations)

[nik9000]

I did a little looking into this yesterday afternoon and made some progress. I think a global-ords-based solution is something we could have fairly easily. The trouble is that most of the time when we have global ords implementations they are speed ups for a "Map" based solution as well. I don't think a map based solution would work as well in this situation. But I'll have a think. Would it be ok to only do global ords at first? That means that things like runtime fields wouldn't work here.

[dgieselaar]

@nik9000 we are not using runtime fields, so I'm (selfishly) totally okay with leaving that out.

[polyfractal]

I think starting with Ordinals is ok as well. Incremental improvements and all that. 👍