How to keep on x no of recent documents based on field

Elastic Stack Elasticsearch
1

We are trying to evaluate elasticsearch for keeping up our events and very impressed so far.
Though there are two issues we need help with

  • We need to only keep X no of events per MAC address and old events should be purged. Since MAC could be in order of thousands obviously having separate indexes per mac is out of question.
    I am assuming that this should be possible using aggregation and pipelines but now sure how
  • Is there a way we can get metric of No of query served during a time period, we need this info for our own benchmarking purposes.

Thanks in advance.

2

So currently I am using following approach

  • Iterate through all the macs

  • For each mac

      "from": 1000,
          "size": 1,
          "query": {
              "bool": {
                  "must": [{"match_phrase": { "mac": mac  } }]
              }
          },
          "sort": {
              "eTime": {
                  "order": "desc"
              }
         }
      },

  • Once I have that

      POST events-index/_delete_by_query?conflicts=proceed
  {
    "query": {
      "bool" : {
        "must": [
            {"match_phrase": {"mac":  mac}},
            {"range": {"eTime" :{"lte":ts}}}
        ]
        
      }
    }
  }

Now this is certainly not the efficient way, Is there a way to combine all three steps into one aggregation/pipeline.