Query most common conversation enders (Terms / Top Hits aggregation?)

Hi there!

I'm having a hard time coming up with a query [ES 2.3]. I have the following mapping (simplified):

{
  "user_id": 1234,
  "text": "bye bye",
  "created_on": "2017-08-18T00:00:00",
  "direction": "O"
}

I'm now trying to get the most common texts that end a conversation. That is, the number of times each texts appears on the documents with both direction="O" and max(created_on) per user_id.

I thought I'd group all documents by contact with a terms aggregation, and then run a top hits subaggregation, but there are too many users and the query times out.

Is there something in ES that can help me achieve this? Is filtering and computing this offline my best option?

Thanks in advance!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.