A query to match most recent and then bucketing the results


(aviv ratzon) #1

Hello,
I have in my database something like this:

@timestamp: 12/01/2015, BUG_ID: 1, Status: open
@timestamp: 12/01/2015, BUG_ID: 2, Status: open
@timestamp: 13/01/2015, BUG_ID: 3, Status: open
@timestamp: 14/01/2015, BUG_ID: 1, Status: closed
@timestamp: 14/01/2015, BUG_ID: 4, Status: open
@timestamp: 18/01/2015, BUG_ID: 2, Status: closed
@timestamp: 20/01/2015, BUG_ID: 5, Status: open
@timestamp: 21/01/2015, BUG_ID: 1, Status: reopened
@timestamp: 22/01/2015, BUG_ID: 4, Status: fixed

I want to have the possibility to display the current (or at some point of time in the past) status of all the bugs. To do this I have to bucket all bugs by their ID, sort them by their time and set "size = 1".
But what can I do after that?
I am pretty new to elasticsearch and so even the first part is not so easy on me, but I can't think of a way, after I manage to get the most recent documents, how do I analaize the data. I though maybe the most recent could be preformed at the query part but I didn't find an option to do so.
To my understanding if I'll use aggregations I'll get many buckets, each containing one bug and I wouldn't be able to do anything on those results.

I am running ES 2.1.0

Thank you very much,
Aviv


(system) #2