GET giveninja.org_access/_search
{
  "query": {
    "match_all": {}
  },
  "sort": {
    "@timestamp": {
      "order": "asc"
    }
  },
  "aggs": {
    "groupbyip": {
      "terms": {
        "field": "clientip.keyword",
        "size": 1000
      },
      "aggs": {
        "item_data": {
          "top_hits": {
            "sort": [
              {
                "@timestamp": {
                  "order": "asc"
                }
              }
            ],
            "_source": {
              "includes": [
                "message",
                "geoip"
              ]
            },
            "size": 1
          }
        }
      }
    }
  },
  "size": 1
}