弹性搜索查询最大值aggs

Question

I have data like this:

Name     Fees Collected     Date
Name1     100              2017-05-01T12:00:00
Name1     200              2017-05-02T12:00:00
Name2     500              2017-05-05T12:00:00
Name2     600              2017-05-06T12:00:00
Name3     1000             2017-05-010T12:00:00
Name3     1100             2017-05-011T12:00:00
Name4     1500             2017-05-011T12:00:00

How can i write a query to return the aggregation of filtered/grouped to the max Date with min doc count of 2 for each group?

I expect the following output:

Name     Fees Collected   Date  
Name1     200             2017-05-02T12:00:00
Name2     600             2017-05-06T12:00:00
Name3     1100            2017-05-011T12:00:00

Finally, I would get the aggregation as following

"aggregations" {
    "Fees Collected " : "1900" //(200+600+1100)
    }

Is there anyway to achieve this in elastic search? Thank you..

Answer 1

There is a way!

First you need a terms aggregation on "Name" field with addition of "min_doc_count": 3. Then a sub max_aggregation on field "Date".

somthing like this:

"aggs": {
 "split_by_name": {
  "terms": {
    "field": "Name",
    "min_doc_count": 3
  },
  "aggs": {
    "max_date": {
      "max": {
        "field": "Date"
        }
      }
    }
  }
}