Clever Geek Handbook

Elasticsearch gets the latest documents grouped by multiple fields

Similarly Query the last document of each type on Elasticsearch , I have a set of records in ES. For the sake of example, let's say this is news, each with mapping:

"news": {
    "properties": {
        "source": { "type": "string", "index": "not_analyzed" },
        "headline": { "type": "object" },
        "timestamp": { "type": "date", "format": "date_hour_minute_second_millis" },
        "user": { "type": "string", "index": "not_analyzed" }
        "newspaper": { "type": "string", "index": "not_analyzed"}
    }
}

I can get the latest "news article" for each user:

"size": 0,
"aggs": {
    "sources" : {
        "terms" : {
            "field" : "user"
        },
        "aggs": {
            "latest": {
              "top_hits": {
                "size": 1,
                "sort": {
                  "timestamp": "desc"
                }
              }
            }
        }
    }
}

However, I am trying to get the latest article for each user, per newspaper , and I cannot get it right.

eg.

  • John, New York Times , Title1
  • John, BBC , Title2
  • Jane, New York Times , Title3
  • and etc.
0


source to share


1 answer


You can add another subaggregated terms

for the field newspaper

like this



"size": 0,
"aggs": {
    "sources" : {
        "terms" : {
            "field" : "user"
        },
        "aggs": {
            "newspaper": {
               "terms": {
                  "field": "newspaper"
               },
               "aggs": {
                  "latest": {
                     "top_hits": {
                       "size": 1,
                       "sort": {
                          "timestamp": "desc"
                       }
                     }
                  }
               }
            }
        }
    }
}
0


source






More articles:


All Articles