hello everyone,
I'm using a visualisation to contrôle the received documents in ES (with top_hits on meta.localtime field).
the generated request:
{
"query": {
"bool": {
"must": [
{
"match_all": {}
},
{
"range": {
"ended": {
"gte": 1507827469811,
"lte": 1515603469811,
"format": "epoch_millis"
}
}
}
],
"must_not": []
}
},
"size": 0,
"_source": {
"excludes": []
},
"aggs": {
"2": {
"terms": {
"field": "meta.srcMaster",
"size": 9999,
"order": {
"_term": "desc"
}
},
"aggs": {
"3": {
"terms": {
"field": "@policy",
"size": 99999,
"order": {
"_term": "desc"
}
},
"aggs": {
"1": {
"top_hits": {
"docvalue_fields": [
"meta.localtime"
],
"_source": "meta.localtime",
"size": 1,
"sort": [
{
"meta.localtime": {
"order": "desc"
}
}
]
}
}
}
}
}
}
}
}
I want to filter results to get lines with the top_hits aggregation "1" lower then "now-24h"
I tried ti use "lt":"now-24h". But the top_hits can't parse the query.
Thanx in advance for the help.
Regards