# Count Last received logs

**URL:** <https://discuss.elastic.co/t/count-last-received-logs/303024>\
**Category:** Kibana\
**Created:** [April 22, 2022, 11:36am UTC](https://discuss.elastic.co/t/count-last-received-logs/303024 "2022-04-22T11:36:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bo-Wyatt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bo-wyatt/32/87748_2.png) [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\
**Post date:** [April 22, 2022, 11:36am UTC](https://discuss.elastic.co/t/count-last-received-logs/303024/1 "2022-04-22T11:36:26Z")

</div>

Hello, I have a SIEM-like flow o logs. I mean, 3 or more logs with an identifier (same value in all the logs). My last received log the one I want to "keep" or "consider". Is there any way to apply this concept to my Visualization? I mean, if I do a count on the documents, it counts all the "repeated" logs so there's an incorrect value, there's a form to do a "delta" or tell Kibana to only count the last log of that flow? I hope I've explained myself correctly. Thanks.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 22, 2022, 6:59pm UTC](https://discuss.elastic.co/t/count-last-received-logs/303024/2 "2022-04-22T18:59:15Z")

</div>

I would build a "Latest Transform" which is pretty much exactly what you're asking for That will create a new index and then allows you to do visualizations from it.

> **[Transform overview | Elasticsearch Guide \[8.1\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.1/transform-overview.html#latest-transform-overview)**

For example, I've used this to get the last log from each host and that way I can see what the last log is and I see when the last time it checked in. Instead of host as the the unique key you would use your identifier

If you just follow the builder example, you should be able to create one.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2022, 6:59pm UTC](https://discuss.elastic.co/t/count-last-received-logs/303024/3 "2022-05-20T18:59:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.