elasticsearch_query_find_duplicates.json

{
   "size": 0,
   "query": {
      "query_string": {
         "query": "blacklist"
      }
   },
   "aggs": {
      "dup": {
         "terms": {
            "field": "api_spam_blacklist_data.hash",
            "min_doc_count": 2
         },
         "aggs": {
            "doc": {
               "top_hits": {
                   "size" : 1,
                   "fields" : [],
                  "sort": {
                     "date": "asc"
                  }
               }
            }
         }
      }
   }
}