First occurrence field value using ingest processor

[liorg2]

Hello

is there a way to tag a document with "first occurrence of a field" using an ingest processor?

for example first occurrence of traffic from Japan (country:Japan)

thanks

[Mark_Harwood]

Would it be easier to derive on the fly? This is an example query to find the first uses of popular tags on stackoverflow:

GET stackoverflow/_search
{
  "size":0,
  "aggs":{
	"tags":{
	  "terms":{
		"field": "tag",
		"collect_mode":"breadth_first"
	  },
	  "aggs":{
		"first_use":{
		  "top_hits": {
			"size": 1,
			"sort":[{ "creationDate" : {"order" : "asc"}}]
		  }
		}
	  }
	}
  }
}

[liorg2]

@Mark_Harwood

GET stackoverflow/_search
{
  "size":0,
  "aggs":{
	"tags":{
	  "terms":{
		"field": "tag",
		"collect_mode":"breadth_first"
	  },
	  "aggs":{
		"first_use":{
		  "top_hits": {
			"size": 1,
			"sort":[{ "creationDate" : {"order" : "asc"}}]
		  }
		}
	  }
	}
  }
}

nice thanks!