elasticsearch - 如何通过获取最早的条目

Question

对于以下事件:

{
    "time": 10,
    "name": "John",
    "status": true 
},
{
    "time": 20,
    "name": "John",
    "status": false
},
{
    "time": 20,
    "name": "Mary",
    "status": false
},
{
    "time": 10,
    "name": "Mary",
    "status": true
}

在给定的 time中搜索最古老的那些(字段 name(1))的正确方法是什么？

对于上面的示例，这意味着

{
    "time": 20,
    "name": "John",
    "status": false
},
{
    "time": 20,
    "name": "Mary",
    "status": false
},

我尝试使用 order in aggregations来实现，

{
  "query": {
    "match_all": {

    }
  },
  "aggs": {
    "shortlist": {
      "terms": {
        "field": "name",
        "size": 1,
        "order" : { "time" : "asc" }
      }
    }
  }
}

但是我得到了

"error": {
      "root_cause": [
         {
            "type": "aggregation_execution_exception",
            "reason": "Invalid term-aggregator order path [time]. Unknown aggregation [time]"
         }

坦率地说，我不明白。

(1)这实际上是一个纪元时间戳，但是为了简单起见，我使用了一个简短的int

Answer 1

这样的事情应该做到这一点:

{
  "size": 0,
  "aggs": {
    "by_name": {
      "terms": {
        "field": "name",
        "size": 10
      },
      "aggs": {
        "top1": {
          "top_hits": {
            "size": 1,
            "sort": [{"time":{"order": "desc"}}]
          }
        }
      }
    }
  }
}