gistfile1.txt

POST /ledger/_search?size=0
{
"size" : 0,
 "aggs": {
   "by-key": {
     "terms": {  "field": "alert_key",   "size": 10   },
     "aggs": {
       "firing-only"    : { "filter":  { "term": { "state": "fire" } } ,    "aggs": { "max-firing-only":  { "max": { "field": "@timestamp"  } }   } },
       "resolve-only"   : { "filter" : { "term": { "state" : "resolve" } }, "aggs": { "max-resolve-only": { "max": { "field": "@timestamp"  } }   } },
       "my-decorations"  : { "bucket_selector": { 
         "buckets_path": {"maxFiring" : "firing-only>_count", "maxResolve" : "resolve-only>_count"},  
         "script": "return (params.maxFiring > params.maxResolve)" } },
       "my-toppest" : { "top_hits": {  "size": 1   }
       }
     }
   }
  }
}