Unable to get terms + terms + top hits aggregation

Elastic Stack Elasticsearch
1

Hi, I am trying to do a terms + terms + top hits aggregation on an index of ~5.4m documents.
The relevant fields are equipment ID, location, and the timestamp.

I want to get the latest location of the equipment via the latest timestamp, and use only that latest location to aggregate into location buckets with the count of equipment in that location.

Here's what I have so far:

    {
     "track_total_hits": True,
     "size": 0,
     "aggs" : {
      "pol": {
       "terms": {
        "field": "nest.eventLoc.keyword",
        "size": loc_count
       },
       "aggs": {
        "eqpmt": {
         "terms": {
          "field": "nest.eqpmtId.keyword",
          "size": eqpmt_count,
         },
         "aggs": {
          "latest": {
           "top_hits": {
            "sort": [
            	{ "nest.actualDateTime": { "order": "desc" } }
            	],
            	"size": 1,
                "_source" : False
           }
          }
         }
        }
       }
      }
     }
    }

The end result is returning count of all documents by location (i.e., duplicate equipment IDs), and not the count of unique documents by their latest location. Am I missing some keyword somewhere?

I am on 7.6.1.
Thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.