Kibana Lucene search of an array field

Hi there. I have a few docs in an index that go as the following example:

'''
"_index" : "metrics",
"_type" : "_doc",
"_id" : "5fd1814e8a7b8b0023d747d5",
"_source" : {
"socketId" : "hh9WMhPM1z1tD8SyAAdN",
"events" : [
{
"_id" : "5fd1814e8a7b8b0023d747d6",
"event" : "ENTER_QUEUE",
"createdAt" : "2020-12-10T02:00:46.510000",
"updatedAt" : "2020-12-10T02:00:46.510000"
},
{
"_id" : "5fd182058a7b8b0023d747e8",
"event" : "IN_ATTEND",
"updatedAt" : "2020-12-10T02:03:49.528000",
"createdAt" : "2020-12-10T02:03:49.528000"
},
{
"_id" : "5fd1820e8a7b8b0023d747f4",
"event" : "IN_SATISFACTION_SURVEY",
"updatedAt" : "2020-12-10T02:03:58.059000",
"createdAt" : "2020-12-10T02:03:58.059000"
},
{
"_id" : "5fd182178a7b8b0023d74802",
"event" : "FINISH_ATTEND",
"updatedAt" : "2020-12-10T02:04:07.367000",
"createdAt" : "2020-12-10T02:04:07.367000"
},
{
"_id" : "5fd1824d8a7b8b0023d74843",
"event" : "FINISH_SATISFACTION_SURVEY",
"updatedAt" : "2020-12-10T02:05:01.833000",
"createdAt" : "2020-12-10T02:05:01.833000"
}
],
"createdAt" : "2020-12-10T02:00:46.510000",
"updatedAt" : "2020-12-10T02:05:01.833000",
"__v" : 0
}
'''

The field "events" is a list of many possible events.
In the Kibana Lucene search bar, I'm trying to get all the docs that have the last field "event" inside the list "events" matching "ENTER_QUEUE". (There is a visual counting the results).

I've managed to get all docs which contain the event "ENTER_QUEUE" querying:
{"match":{"events.event":"ENTER_QUEUE"}}

But i need only the docs in which the last event is "ENTER_QUEUE".
I figured it would be something like:
{"match":{"events[-1].event":"ENTER_QUEUE"}} or something like this, but I can't figure it out.

Is there anyway to query for the last element in a list?

-- I don't know if it helps, but here is the mappings:

'''
"mappings" : {
"properties" : {
"metric" : {
"type" : "nested",
"properties" : {
"_id" : {
"type" : "text"},
"_index" : {
"type" : "text"},
"_type" : {
"type" : "text"},
"_source" : {
"type" : "nested",
"properties" : {
"_id" : {
"type": "text"},
"socketId" : {
"type" : "text"},
"events" : {
"type" : "nested",
"properties" : {
"_id" : {
"type": "text"},
"event" : {
"type" : "text"},
"createdAt" : {
"type" : "date"},
"updatedAt" : {
"type" : "date"}
}
},
"createdAt" : {
"type" : "date"},
"updatedAt" : {
"type" : "date"},
"__v" : {
"type" : "long"}
}
}
}
}
}
}
'''

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.