Get oldest / newest document in *beat

[EricJohnson]

In order to get around this problem I am changing my approach. Of course it created a new issue... But here's the follow up question:

Aggregate metricbeat 'host' info by ID & Unique host configuration?

Hi there. I'm trying to aggregate host configuration data out of metricbeat. I need to look at the documents for a single day, bucketing by ID, and return the host info. What I'm trying to do is watch for configuration changes on a daily basis. If I use this code: "query": { 'bool': { 'must': [ {"exists": {"field": "host"}}, {'term': {'@timestamp': date}} ] } }, "aggs": { "by_id": { "terms": {"field": "fields.id"} } } I get an array out containing our fields.id …

Thank you!