Collapse rows in data table

Elastic Stack Kibana
1

Pasted image981×270 13 KB

This is my table.

As you see, there are 6 fields: layer, domain, componentType, serviceName, operation and version.
There are 3 rows where those fields are all the same.
If those 6 fields are the same, I wanto to show only 1 row, so I want to collapse those rows onto one.
And when I do it, I want show only the row with the most recent time.
I don't know if you understand me.
i want to show only this row:

Pasted image980×67 2.54 KB

2

If those 6 fields are the same, I wanto to show only 1 row

Then you want to have your Data Table visualization split by only those 6 terms. So I would remove the state term from your aggregation since it's not one of the 6 you're interested in.

The first and last row are both showing because your primary aggregation is a Date Histogram with a 30s interval. The first and last row are in different time buckets. Actually the second row is in its own time bucket as well.

If you truly want every similar doc aggregated together, remove the Date Histogram aggregation. You could also try making the interval larger.

3

But I want to show the current state, so capture the most recent time, because the state can switch between true and false and I want to show the current one.