gistfile1.txt

Elasticsearch query

          "aggs": {
            "by_site": {
              "terms": {
                "field": "site",
                "size": 500
              },
              "aggs": {
                "by_top_hits" : {
                  "top_hits": {
                    "size": 1,
                    "_source": ["site_type"],
                    "sort": [ { "@timestamp": {  "order": "desc"  }  }  ]
                  }
                }
              }
             }              
--------------------------------------------------------------------------------------              
Vega

  {
      "name": "joined",
      "source": "alerts",
      "transform": [ { "type": "lookup", "from": "site_to_sitetype", "key": "site", "values": ["site_type"], "fields": ["site"], "as": ["site_typer"], "default" : "no-site-type"   }  ]
  },