Get a count of values from the most recent document

Elastic Stack Elasticsearch
1

I can't get a count of fields with a filtered document value.

I have this json

 {
"took" : 6,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "net",
        "_type" : "_doc",
        "_id" : "RTHRTH",
        "_score" : 1.0,
        "_source" : {
          "created_at" : "2020-05-31 19:01:01",
          "data" : [...]
      {
        "_index" : "net",
        "_type" : "_doc",
        "_id" : "LLLoIJBHHM",
        "_score" : 1.0,
        "_source" : {
          "created_at" : "2020-06-23 15:11:59",
          "data" : [...]
        }
      }
    ]
  }
}

In the "data" field, there are more fields within other fields respectively.

I want to filter the most recent document, and then count a certain value in the most recent document. This is my query:

{
  "query": {
    "match": {
      "domain.keyword": "net"
    }
  },
  "sort": [
    {
      "created_at.keyword": {
        "order": "desc"
      }
    }
  ],
  "size": 1,
  "aggs": {
    "CountValue": {
      "terms": {
        "field": "data.add.serv.desc.keyword",
        "include": "nginx"
      }
    }
  }
}

And the output is:

{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "CountValue" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "nginx",
          "doc_count" : 2
        }
      ]
    }
  }

I suspect that doc_count is the number of documents the value appears in, not the number of times the value is repeated within the filtered document.
Any advice I will be very grateful!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.