SELECT vtr.id as id, domain_name, vpn_user, ip_address, http_port, time, FROM_UNIXTIME(TIME,'%Y-%m-%d %H:%i:%S') AS happenTime, dw.`deviceID`, d.`systemType`, d.`devTypeID`,b.`location`, lm.`referenceName`, tm.`partyUnitName`, tm.`safetyGearName`,vtr.estime FROM parter_upgrade_scs_saas_main.video_traffic_record vtr INNER JOIN parter_upgrade_scs_device.device_webcam dw on (vtr.domain_name = dw.domain and vtr.http_port = dw.httpPort) LEFT JOIN parter_upgrade_scs_device.device d ON dw.deviceID = d.id LEFT JOIN parter_upgrade_scs_resource.`bewatched` b ON d.`ownerID`= b.`id` AND d.`ownerType`=2 LEFT JOIN parter_upgrade_scs_saas_main.lease_manage lm ON d.leaseID = lm.id LEFT JOIN parter_upgrade_scs_saas_main.tenant_manage tm ON lm.tenantID = tm.id用elasticsearch怎么写？

以下是一个可能的Elasticsearch查询：

POST parter_upgrade_scs_saas_main.video_traffic_record/_search
{
  "_source": ["id", "domain_name", "vpn_user", "ip_address", "http_port", "time", "estime"],
  "query": {
    "bool": {
      "must": [
        {
          "exists": {
            "field": "estime"
          }
        }
      ]
    }
  },
  "aggs": {
    "group_by": {
      "composite": {
        "size": 1000,
        "sources": [
          {
            "domain_name": {
              "terms": {
                "field": "domain_name"
              }
            }
          },
          {
            "http_port": {
              "terms": {
                "field": "http_port"
              }
            }
          },
          {
            "date": {
              "date_histogram": {
                "field": "time",
                "calendar_interval": "day",
                "format": "yyyy-MM-dd"
              }
            }
          }
        ]
      },
      "aggs": {
        "id": {
          "top_hits": {
            "size": 1,
            "_source": ["id"]
          }
        },
        "vpn_user": {
          "top_hits": {
            "size": 1,
            "_source": ["vpn_user"]
          }
        },
        "ip_address": {
          "top_hits": {
            "size": 1,
            "_source": ["ip_address"]
          }
        },
        "happenTime": {
          "top_hits": {
            "size": 1,
            "_source": {
              "script": {
                "source": "doc['time'].value.toInstant().atZone(ZoneId.of('Asia/Shanghai')).format(DateTimeFormatter.ofPattern('yyyy-MM-dd HH:mm:ss'))"
              }
            }
          }
        },
        "deviceID": {
          "terms": {
            "field": "deviceID"
          }
        },
        "systemType": {
          "terms": {
            "field": "systemType"
          }
        },
        "devTypeID": {
          "terms": {
            "field": "devTypeID"
          }
        },
        "location": {
          "top_hits": {
            "size": 1,
            "_source": ["location"],
            "script_fields": {
              "location": {
                "script": {
                  "source": "doc['location'].value"
                }
              }
            }
          }
        },
        "referenceName": {
          "top_hits": {
            "size": 1,
            "_source": {
              "script": {
                "source": "doc['location'].value != null ? doc['location'].value : ''"
              }
            },
            "script_fields": {
              "referenceName": {
                "script": {
                  "source": "def location = doc['location'].value != null ? doc['location'].value : ''; def parts = location.split('/'); parts.length > 0 ? parts[0] : ''"
                }
              }
            }
          }
        },
        "partyUnitName": {
          "top_hits": {
            "size": 1,
            "_source": {
              "script": {
                "source": "doc['deviceID'].value != null ? doc['deviceID'].value : ''"
              }
            },
            "script_fields": {
              "partyUnitName": {
                "script": {
                  "source": "def deviceID = doc['deviceID'].value != null ? doc['deviceID'].value : ''; def parts = deviceID.split('_'); parts.length > 0 ? parts[0] : ''"
                }
              }
            }
          }
        },
        "safetyGearName": {
          "top_hits": {
            "size": 1,
            "_source": {
              "script": {
                "source": "doc['deviceID'].value != null ? doc['deviceID'].value : ''"
              }
            },
            "script_fields": {
              "safetyGearName": {
                "script": {
                  "source": "def deviceID = doc['deviceID'].value != null ? doc['deviceID'].value : ''; def parts = deviceID.split('_'); parts.length > 1 ? parts[1] : ''"
                }
              }
            }
          }
        }
      }
    }
  }
}

这个查询会按照`domain_name`，`http_port`和日期分组，同时在每个组内找到满足`estime`字段存在的文档，并从中提取所需的字段。其中，`happenTime`字段使用脚本来将UNIX时间戳转换为本地时间，`location`字段使用脚本来提取其中的第一部分作为`referenceName`，`deviceID`字段使用脚本来提取其中的第一部分作为`partyUnitName`，提取第二部分作为`safetyGearName`。

请注意，这个查询可能需要根据您的数据模型和查询需求进行适当的调整。