I'm trying to retrieve only the documents (inner_hits) with the specific keyword and then trying to group the documents based on a certain field (collapse).
{
"_source": false,
"query": {
"bool": {
"filter": [
{
"range": {
"alert_docs_count": {
"gt": 0
}
}
},
{
"nested": {
"path": "alert_docs",
"query": {
"terms": {
"alert_docs.tags.keyword": [
"anonymous_login_detected"
]
}
},
"inner_hits": {}
}
}
]
}
},
"collapse": {
"field": "alert_name.keyword",
"inner_hits": {
"size": 1000,
"name": "alert_name",
"_source": [
"alert_name",
"alert_docs",
"alert_time"
],
"sort": [
{
"alert_time": "desc"
}
]
}
}
}