The top level will update when user change the userinfo or new register.
the second level will update when action login disappeared
the lastest level will update more often, as the device will keep sending message to elastic.
So the docs inside top level and second level may will not update often, while docs of the latest level will increase fast(every message sended will treat as a new doc).