suppose mapping that
"user_access" : {
"ip" : "19x.xxx.xxx.xxx",
"time" : 12312112
"login_id" : "somthing id"
}
So i want to make Terms aggregations with "login_id" field. becuz i have to know
multiple ip per login_id and additional fields : time(last) and ip(at last time doocument).
Its my query.
{
"size" : 0,
"aggs" : {
"term_id" : {
"terms" : {
"field" : "user_access.login_id",
"order" : {"term_ip.value" : "desc"}
},
"aggs" : {
"term_ip" : {
"cardinality" : {"field" : "user_access.ip"}
},
"last_access" : {
"max" : {"field" : "access_time"}
}
}
}
}
}
In my query, i can get last access time field`s value but cant ip(same document)
How can i get ip field ??