elasticsearch - How to get the oldest entry by <field> -
for events below:
{ "time": 10, "name": "john", "status": true }, { "time": 20, "name": "john", "status": false }, { "time": 20, "name": "mary", "status": false }, { "time": 10, "name": "mary", "status": true }
what correct way of searching oldest ones (field time
(1)) given name
?
for example above, means
{ "time": 20, "name": "john", "status": false }, { "time": 20, "name": "mary", "status": false },
i tried use order in aggregations that, along lines of
{ "query": { "match_all": { } }, "aggs": { "shortlist": { "terms": { "field": "name", "size": 1, "order" : { "time" : "asc" } } } } }
but a
"error": { "root_cause": [ { "type": "aggregation_execution_exception", "reason": "invalid term-aggregator order path [time]. unknown aggregation [time]" }
which frank not understand.
(1) epoch timestamp used short int simplicity
something should it:
{ "size": 0, "aggs": { "by_name": { "terms": { "field": "name", "size": 10 }, "aggs": { "top1": { "top_hits": { "size": 1, "sort": [{"time":{"order": "desc"}}] } } } } } }
Comments
Post a Comment