First occurrence field value using ingest processor


is there a way to tag a document with "first occurrence of a field" using an ingest processor?

for example first occurrence of traffic from Japan (country:Japan)


Would it be easier to derive on the fly? This is an example query to find the first uses of popular tags on stackoverflow:

GET stackoverflow/_search
		"field": "tag",
		  "top_hits": {
			"size": 1,
			"sort":[{ "creationDate" : {"order" : "asc"}}]

nice thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.