How to select the last bucket in a date_histogram selector in Elasticsearch

Question

I have a date_histogram and I can use max_bucket to get the bucket with the greatest value, but I want to select the last bucket (ie the bucket with the highest timestamp).

Using max_bucket to get the greatest value works OK, but I don't know what to put in the buckets_path to get the last bucket.

My mapping:

{
  "ee-2020-02-28" : {
    "mappings" : {
      "dynamic" : "strict",
      "properties" : {
        "date" : {
          "type" : "date"
        },
        "frequency" : {
          "type" : "long"
        },
        "keyword" : {
          "type" : "keyword"
        },
        "text" : {
          "type" : "text"
        }
      }
    }
  }
}

My working query, which returns the bucket for the day with higher frequency (it's named last_day because this is a WIP query to get to my goal):

{
    "query": {
        "range": {
            "date": { /* Start away from the begining of data, so the rolling avg is full */
                "gte": "2019-02-18"/*,
                "lte": "2020-12-14"*/
            }
        }
    },
    "aggs": {
        "palabrejas": {
            "terms": {
                "field": "keyword",
                "size": 100
            },
            "aggs": {
                "nnndiario": {
                    "date_histogram": {
                        "field": "date",
                        "calendar_interval": "day"
                    },
                    "aggs": {
                        "dailyfreq": {
                            "sum": {
                                "field": "frequency"
                            }
                        }
                    }
                },
                "ventanuco": {
                    "avg_bucket": {
                        "buckets_path": "nnndiario>dailyfreq",
                        "gap_policy": "insert_zeros"
                    }
                },
                "last_day": {
                    "max_bucket": {
                        "buckets_path": "nnndiario>dailyfreq"
                    }
                }
            }
        }
    }
}

Its output (notice I replaced long parts with [...] ):

{
  "aggregations" : {
    "palabrejas" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "rama0",
          "doc_count" : 20400,
          "nnndiario" : {
            "buckets" : [
              {
                "key_as_string" : "2020-01-01T00:00:00.000Z",
                "key" : 1577836800000,
                "doc_count" : 600,
                "dailyfreq" : {
                  "value" : 3000.0
                }
              },
              {
                "key_as_string" : "2020-01-02T00:00:00.000Z",
                "key" : 1577923200000,
                "doc_count" : 600,
                "dailyfreq" : {
                  "value" : 3000.0
                }
              },
              {
                "key_as_string" : "2020-01-03T00:00:00.000Z",
                "key" : 1578009600000,
                "doc_count" : 600,
                "dailyfreq" : {
                  "value" : 3000.0
                }
              },
              [...]
              {
                "key_as_string" : "2020-01-31T00:00:00.000Z",
                "key" : 1580428800000,
                "doc_count" : 600,
                "dailyfreq" : {
                  "value" : 3000.0
                }
              }
            ]
          },
          "ventanuco" : {
            "value" : 3290.3225806451615
          },
          "last_day" : {
            "value" : 12000.0,
            "keys" : [
              "2020-01-13T00:00:00.000Z"
            ]
          }
        },
        {
          "key" : "rama1",
          "doc_count" : 20400,
          "nnndiario" : {
            "buckets" : [
              {
                "key_as_string" : "2020-01-01T00:00:00.000Z",
                "key" : 1577836800000,
                "doc_count" : 600,
                "dailyfreq" : {
                  "value" : 3000.0
                }
              },
              [...]
            ]
          },
          "ventanuco" : {
            "value" : 3290.3225806451615
          },
          "last_day" : {
            "value" : 12000.0,
            "keys" : [
              "2020-01-13T00:00:00.000Z"
            ]
          }
        },
        [...]
        }
      ]
    }
  }
}

I don't know what to put in last_day 's buckets_path to obtain the last bucket.

Answer 1

You might consider using a terms aggregation instead of a date_histogram -aggregation:

"max_date_bucket_agg": {
  "terms": {
    "field": "date",
    "size": 1, 
    "order": {"_key": "desc"} 
  }
}

An issue might be the granularity of your data, you may consider storing the date-value of the expected granularity (eg day) in a separate field and use that field in the terms -aggregation.