Elasticsearch top_hits aggregation vs latest document
I think what you want is field collapsing, which is faster than an aggregation.
Something like this should work for your use case:
GET my-index/_search { "query": { "match_all": { } }, "collapse" : { "field" : "fields.username.keyword" }, "sort": [ { "@timestamp": { "order": "desc" } } ] }I might be missing something, but I don't think Kibana supports this at the moment.