# Aggs / Max timestamp Term query issue
**URL:** https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604
**Category:** Elasticsearch
**Created:** [December 12, 2018, 6:54pm UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604 "2018-12-12T18:54:55Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)
#### Post date: [December 12, 2018, 6:54pm UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604/1 "2018-12-12T18:54:55Z")
When I execute this query:
GET /logstash\*/\_search?size=0
{
"aggs" : {
"max\_timestamp" : { "max" : { "field" : "@timestamp" } }
}
}
I get this result:
.
.
},
"aggregations" : {
"max\_timestamp" : {
"value" : 1.544640671569E12,
"value\_as\_string" : "2018-12-12T18:51:11.569Z"
}
}
}
However, when I execute the following query:
GET /logstash\*/\_search
{
"aggs" : {
"max\_timestamp" : { "max" : { "field" : "@timestamp" } }
},
"query": {
"term": {"@timestamp": "max\_timestamp"}
}
}
I get the following results:
"error": {
"root\_cause": [
{
"type": "parse\_exception",
"reason": "failed to parse date field [max\_timestamp] with format [strict\_date\_optional\_time||epoch\_millis]"
},
{
"type": "parse\_exception",
"reason": "failed to parse date field [max\_timestamp] with format [strict\_date\_optional\_time||epoch\_millis]"
},
{
"type": "parse\_exception",
"reason": "failed to parse date field [max\_timestamp] with format [strict\_date\_optional\_time||epoch\_millis]"
},
How can I correct this situation?
---
### Author:  [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)
#### Post date: [December 13, 2018, 9:38am UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604/2 "2018-12-13T09:38:28Z")
Hi,
First I suggest to say "hi or hello", "bye", "thanks". and give details about your ES version etc...
Read : [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html)
Because this not a valid query :
```
"term": {"@timestamp": "max_timestamp"}
```
bye ,
Xavier
---
### Author:  [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)
#### Post date: [December 13, 2018, 2:06pm UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604/3 "2018-12-13T14:06:33Z")
Xavier,
Thank you for your reply.
I am attaching a Word doc that outlines the issue.
Regards,
Michael
Michael Golubov
QT IT - Trading Tools - US
()
(Attachment Xavier\_ELK1.docx is missing)
---
### Author:  [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)
#### Post date: [December 13, 2018, 2:19pm UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604/4 "2018-12-13T14:19:54Z")
Xavier,
Thank you for replying – here is what I am attempting to do
1.
```
Here is an aggs / max search where I have copied the value of the return
```
1.
```
Manually inserting the value into a term search, I get exactly what I need:
```
1.
```
Given the above two search, I was hoping that “max_timestamp” would be treated as a dynamic variable which I could use as follows below. Clearly, it doesn’t work that way, and I am hoping that there is some way I can ‘pipeline’ the result of an aggs / max search into a term search. I am using version 6.5.0 of ELK.
```
Thank you,
Michael
Michael Golubov
QT IT - Trading Tools - US
()
---
### Author:  [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)
#### Post date: [December 13, 2018, 2:34pm UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604/5 "2018-12-13T14:34:28Z")
Hi,
I'm not certain of what you are expected, but you have to know that in the query ("term": {"@timestamp": "max\_timestamp"}) you have to provide a value that will be used to filter documents.
Relation between query and aggregration are not in the way you are expected.
You run a query on your documents, they are filtered with query elements (timestamp, field value etc..) and finaly you can have aggregations based on this results.
Hope it's clear,
Xavier
---
### Author:  [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)
#### Post date: [December 13, 2018, 2:36pm UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604/6 "2018-12-13T14:36:57Z")
Just a question: what are you looking for into your documents ?
---
### Author:  [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)
#### Post date: [December 13, 2018, 3:59pm UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604/7 "2018-12-13T15:59:13Z")
Xavier,
Replying to your latest post:
I need to monitor a discrete set of services (11 in this case) sent by metricbeat via logstash into elasticsearch.
I need to make sure that only 11 are displayed when the data is refreshed from logstash (every 30 seconds) The following query works most of the time:
However, there are instances where the following happens. Duplicated data (11 extra) is displayed for 5 seconds and is cleared on refresh. I am trying to adjust
the above query to only display data from the latest timestamp in the range. I think that the query examples I sent would work to do this if the latest timestamp could be calculated in the term query.
Michael Golubov
QT IT - Trading Tools - US
()
---
### Author:  [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)
#### Post date: [December 13, 2018, 4:46pm UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604/8 "2018-12-13T16:46:25Z")
Ok if I resume, you want to see the lastest update of each service , is that ok ?
---
### Author:  [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)
#### Post date: [December 13, 2018, 5:26pm UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604/9 "2018-12-13T17:26:04Z")
Yes, the display would only have to be updated if the status of a service changes.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 10, 2019, 5:26pm UTC](https://discuss.elastic.co/t/aggs-max-timestamp-term-query-issue/160604/10 "2019-01-10T17:26:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.