Elasticsearch get the latest documents, grouped by multiple fields

Question

Similarly to Query the latest document of each type on Elasticsearch, I have a set of records in ES. For the sake of the example, lets say it's news as well, each with mapping:

"news": {
    "properties": {
        "source": { "type": "string", "index": "not_analyzed" },
        "headline": { "type": "object" },
        "timestamp": { "type": "date", "format": "date_hour_minute_second_millis" },
        "user": { "type": "string", "index": "not_analyzed" }
        "newspaper": { "type": "string", "index": "not_analyzed"}
    }
}

I am able to get the latest 'news article' per user with:

"size": 0,
"aggs": {
    "sources" : {
        "terms" : {
            "field" : "user"
        },
        "aggs": {
            "latest": {
              "top_hits": {
                "size": 1,
                "sort": {
                  "timestamp": "desc"
                }
              }
            }
        }
    }
}

However what I am trying to achieve is to get the last article per user, per newspaper and I cannot get it quite right.

e.g.

• John, NY Times, Title1
• John, BBC, Title2
• Jane, NY Times, Title3
• etc.

Answer 1

You can add another terms sub-aggregation for the newspaper field like this

"size": 0,
"aggs": {
    "sources" : {
        "terms" : {
            "field" : "user"
        },
        "aggs": {
            "newspaper": {
               "terms": {
                  "field": "newspaper"
               },
               "aggs": {
                  "latest": {
                     "top_hits": {
                       "size": 1,
                       "sort": {
                          "timestamp": "desc"
                       }
                     }
                  }
               }
            }
        }
    }
}