Hi,
I'm trying to create periodically a new index based on aggregation, something like:
"size": 0,
"aggs": {
"group_by_xpto": {
"terms": {
"field": "xpto.keyword",
"size": 10000
},
"aggs": {
"latest_position": {
"max": {
"field": "PositionX"
}
},
"include_source": {
"top_hits": {
"size": 1,
"_source": {
"includes": [
"Field1","Field2","Field3"
]
}
}
}
}
}
}
}
I tried several approaches, Rollup jobs, Transformations, but none seems to support the type of aggregation I need. The last attempt was using Logstash with a schedule input and output, but it seems that aggregations are not supported, https://github.com/logstash-plugins/logstash-input-elasticsearch/issues/58 .
Can someone suggest a solution or the best approach ?
thanks