ELASTICSEARCH - Ordering aggregation by date on nested field

Question

I am developing a query where I count how many unique "cp" the most recent document contains. The json is made up of several nested fields. I am having trouble showing only the json value with the most recent date when I add to a json with nested fields. I have done nested aggregations, and finally I have used top_hits filter to sort in descending order, and it returns me the last one through the size. But still it is returning all the documents with different dates.

JSON:

      "data" : [
        {
          "addresses" : [
            {
              "cp" : "33.33.33",
              "services" : [
                {
                  "field1" : "true",
                  "field2" : "1234",
                }
              ]
            }
          ],
        }
      ],
      "created_at" : "2020-09-03 14:39:01",
      "@timestamp" : "2020-09-04T05:53:22.341661Z",
    }
  },

QUERY:

{"size": 0, 
  "aggs": {
    "nested": {
      "nested": {
        "path": "data.addresses"
     
          },
          "aggs": {
            "nested": {
              "nested": {
                "path": "data.addresses.services"
              },
              "aggs": {
                "filter": {
                  "filter": {
                    "term": {
                      "data.addresses.services.field1.keyword": "true"
                    }
                  },
                  "aggs": {
                    "unique": {
                      "cardinality": {
                        "field": "data.addresses.services.field2.keyword"
                      }
                    },
                    "range":{
                      "top_hits": {
                        "size": 1,
                        "sort": [
                          {"created_at.keyword": {"order": "desc"}}]
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    

I have tried sorting by the predefined field "created_at" or with @timestamp, but the result is the same. Any advice that can help me to solve my problem?

Answer 1

For this case the solution is to add

"order": {
          "_key": "desc":

instead of top_hits.

QUERY

{"size": 0, 
  "aggs": {
    "filtrofecha": {
      "terms": {
        "field": "created_at.keyword",
        "order": {
          "_key": "desc"
        },
        "size": 1
      },
      "aggs": {
        "nested": {
          "nested": {
            "path": "data.addresses"
              },
              "aggs": {
                "nested": {
                  "nested": {
                    "path": "data.addresses.services"
                  },
                  "aggs": {
                    "filter": {
                      "filter": {
                        "term": {
                          "data.addresses.services.field1.keyword": "true"
                        }
                      },
                      "aggs": {
                        "unique": {
                          "cardinality": {
                            "field": "data.addresses.services.field2.keyword"
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }