记一次 es 嵌套索引 查询优化

本人才疏学浅，希望大佬勿喷，欢迎指正
es索引结构：

{
“_index”: “content_audit”,
“_type”: “contentaudit”,
“_id”: “200304010208-1601377383513796”,
“_score”: 1,
“_source”: {
“device_id”: “200304010208”,
“id”: “200304010208-1601377383513796”,
“sip”: “192.168.2.19”,
“sport”: “10289”,
“smac”: “48:8A:D2:B1:17:AC”,
“dip”: “36.99.196.217”,
“dport”: “80”,
“dmac”: “48:46:FB:E8:89:23”,
“xm_dir”: “2”,
“trans_dir”: “2”,
“app_pro”: “Http”,
“protocol”: “http”,
“domain”: “dl.wps.md.wpscdn.cn”,
“mail_from”: null,
“rcpt_to”: null,
“ehlo”: null,
“url”: “”,
“method”: “GET”,
“ret_code”: “200”,
“user_agent”: “-”,
“cookie”: “-”,
“server”: “-”,
“refer”: “-”,
“account”: null,
“pwd”: null,
“sender”: null,
“receiver”: null,
“cc”: null,
“bcc”: null,
“subject”: null,
“msg_content”: null,
“time”: “2020-09-29 11:03:03”,
“content_type”: “1022”,
“source_type”: “2”,
“is_detect”: null,
“detect_time”: null,
“is_upload”: null,
“upload_time”: null,
“if_read”: null,
“handle_status”: null,
“handle_message”: null,
“files”: [
{
“checksum”: “787101d9e86da9365fbe1cdcb0dfbfb6”,
“fileName”: “text_uint_calculation.pptx”,
“text”: "点击此处添加正文。点击此处添加正文，请言简意赅的阐述观点。点击
“typeName”: “财经”,
“typeId”: 0,
“typeScore”: 0.42070859699119717
}
]
},
“highlight”: {
“files.text”: [
“”"为了能让您有更直观的字数感受，并进一步方便使用
]
},
“sort”: [
1,
1601377383000
]
},