es-aggregation1.json

{
  "size": 0,
  "aggregations": {
    "group_by_sessionid": {
      "terms": {
        "field": "sessionid",
        "size": 10,
        "order": {
          "earliest_hit": "desc"
        },
        "min_doc_count": 2
      },
      "aggregations": {
        "top_hits": {
          "top_hits": {
            "size": 5,
            "sort": {
              "creationtime": "asc"
            },
            "_source": {
              "includes": [
                "creationtime",
                "@timestamp",
                "msgtype"
              ]
            }
          }
        },
        "earliest_hit": {
          "min": {
            "field": "@timestamp"
          }
        },
        "latest_hit": {
          "max": {
            "field": "@timestamp"
          }
        }
      }
    }
  }
}