Field Collapsing not working

[jseow (Johnnyow)]

Hi,

I'm having some issues with field-collapsing. I tried the following to no avail.

The query:
{
"size": 1,
"from": 1,
"query": {
"match": { "model": "Sonic"}
},
"sort": [
{
"model": "desc"
}
],
"collapse": {
"field": "model"
}
}

An example of a document:

{
"_index": "device-2020.04.03",
"_type": "_doc",
"_id": "xxxx",
"_version": 1,
"_score": null,
"_source": {
"ip": "xxx.xxx.xxx.xxx",
"gateway": "xxx.xxx.xxx.xxx",
"serial": "xxx",
"network": "xxx",
"interface": "xxx",
"@version": "1",
"type": "xxx",
"@timestamp": "2020-04-03T05:48:22.450Z",
"ip": "xx.xx.xx.xx",
"usingStaticIp": true,
"status": "Active",
"dns": "8.8.8.8, 8.8.4.4",
"model": "Sonic"
},
"fields": {
"@timestamp": [
"2020-04-03T05:48:22.450Z"
]
},
"sort": [
1585892902450
]
}

Say, there's 200 documents and I got 10 different models. I want to get the latest doc for each model. Anyone has any idea? I already did the mapping type to ensure model is a keyword.

[spinscale (Alexander Reelsen)]

Hey,

can you share a simple reproduction with index creation/mapping, sample documents and the query so others can reproduce? Also the Elasticsearch version you are using would be super useful.

One last thing: The count in hits.total will not change, only the documents in the hits.hits array.

Thanks!

--Alex