The system I am using generates logs for every device, each device has a unique serial number(serial_number in logs). As the devices are active we get logs every minute so if some device is closed then we won't receive its log from the next minute till the time it is turned on again.
I want to write a query to list the serial_number of all the devices that are inactive, inactive devices are considered those that were present in logs an hour ago but are not present now. So basically we gotta filter the serial_number of devices that are not being logged from last minute but were getting logged an hour ago, I want to write the query because I am creating a table to visualize so it is must to write a JSON type DSL query.

For Better Understanding of the query that I want to write consider the description "First filter out documents based on unique serial_number that were present an hour ago, then filter out documents based on unique serial_number that were present a minute ago, then filter out the serial_number that were only present an hour ago and are not present now. Write single Elastic DSL query for it."

Don't mark this question a possible duplicate of the question at this link (click here to see)

0

There are 0 best solutions below