How to retrieve last log when grouped by a specific attribute in elasticsearch_dsl?

Question

Need to get the last log (based on timestamp) for each server using python elasticsearch_dsl

for example here are the logs:

Server Hour CPU%

server1 8AM 19
server1 9AM 19
server1 10AM 29
server2 8AM 19
server2 9AM 13
server2 10AM 21
server3 8AM 1
server3 9AM 11
server3 10AM 2

What I want to extract:

server1 10AM 29
server2 10AM 21
server3 10AM 2

I thought starting with something like

s.aggs.bucket('server_bucket','terms', field='server')

but I'm kind of stuck because I don't want a metric, only the last record for each server.

How can I do this?

Answer 1

Got it

    s.aggs.bucket('server', 'terms', field='server').metric('last_log','top_hits',size = 1,_source = ["CPU_PCT","@timestamp"],  sort=[{"@timestamp": {"order": "desc"}}])