GET /my-index-000001/_search { "query": { "match": { "message": "GET /search" } }, "collapse": { "field": "user.id", "inner_hits": [ { "name": "largest_responses", "size": 3, "sort": [ "http.response.bytes" ] }, { "name": "most_recent", "size": 3, "sort": [ { "@timestamp": "asc" } ] } ] }, "sort": [ "http.response.bytes" ] }