We have a series of devices that we track by device name, storing the message that they emit, and the datetime of the message. The devices are come online as system load increases and go offline as load decreases. A device maybe online for as little as a minute or 2, or as much as 8-10 hours or more.
A device is considered "online" via its first message that we receive from it, and is "offline" if it has not emitted messages for 20 minutes. A device may come online/offline multiple times during the requested time window
I need to query for all devices that were online/emitting messages during a time range, returning only 3 fields the device name, the time the device came online, and the time the device went offline
Eventually I'll need to grab all the messages emitted for each device found emitting within the time window, but baby steps to get started.
I have the data in ES7.6, but I don't have an approach on how to solve this which is the actual question. I've looked through all the aggregation docs but nothing is jumping out at me, so reaching out to see about suggestions on an approach. TIA