Query for values not present for the last 90 days

Elastic Stack Elasticsearch
1

Hello forum,
I am trying to wrap my head around a query.

In order to weed out some users i need to search for values in field "data.authenticationInfo.metadata.identifier.keyword" not present in the last 90 days.

Could a kind soul point me in the right direction on how to query for that?

Best regards

Oelsner

2

Some additional context might be useful. Are you using time-based indices? How much data do you have? What is the cardinality of the field you mentioned? Which version of Elasticsearch are you using?

3

Answering the question without knowing the asked context, one possibility is that

  1. terms aggregate on data.authenticationInfo.metadata.identifier.keyword
  2. max aggregation of "time" field as a sub-aggregation for 1.
  3. bucket selector aggregation for the result of max "time" field as a pipeline aggregation for 1.