# Counting the last element of each aggregation
**URL:** https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865
**Category:** Kibana
**Created:** [January 17, 2018, 10:51am UTC](https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865 "2018-01-17T10:51:27Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Tomas\_Law](https://discuss.elastic.co/u/Tomas_Law)
#### Post date: [January 17, 2018, 10:51am UTC](https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865/1 "2018-01-17T10:51:27Z")
Hello,
I have logs with the fields:
. IP
. Timestamp
. URI
. SessionId
Each log shows the time (timestamp) the URI was visited. The SessionId is a field I created by concatenating IP with Timestamp (without the minutes or seconds). That is, all the logs belonging to the same day and hour are grouped into the same SessionId.
For e.g.
IP Timestamp URI SessionId
1.2.3.4 December25th2017T08:30:00 [google.com](http://google.com) 1.2.3.4\_25-12-2017\_8
1.2.3.4 December25th2017T08:45:00 [youtube.com](http://youtube.com) 1.2.3.4\_25-12-2017\_8
1.2.3.4 December25th2017T09:30:00 [facebook.com](http://facebook.com) 1.2.3.4\_25-12-2017\_9
1.2.3.4 December25th2017T09:58:00 [youtube.com](http://youtube.com) 1.2.3.4\_25-12-2017\_9
4.3.2.1 December30th2017T15:20:00 [yahoo.com](http://yahoo.com) 4.3.2.1\_30-12-2017\_15
4.3.2.1 December30th2017T15:30:00 [elastic.com](http://elastic.com) 4.3.2.1\_30-12-2017\_15
4.3.2.1 December30th2017T15:58:00 [youtube.com](http://youtube.com) 4.3.2.1\_30-12-2017\_15
Now, I need to know the top URI that were the last ones to be visited in the sessions.
That is, for the example above, "[youtube.com](http://youtube.com)" was the last URI visited in the following sessions:
. 1.2.3.4\_25-12-2017\_8
. 1.2.3.4\_25-12-2017\_9
. 4.3.2.1\_30-12-2017\_15
Therefore, I need a visualization/query that indicates something like:
URI Count
[youtube.com](http://youtube.com) 3
I've tried doing a couple split rows aggregations and filters but none of them gets me the result I want.
How can I achieve this in Kibana?
Thank you
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [January 17, 2018, 4:29pm UTC](https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865/2 "2018-01-17T16:29:52Z")
Hi @Tomas_Law,
Try using a Terms aggregation, like this:
Let me know if that helps!
---
### Author:  [@Tomas\_Law](https://discuss.elastic.co/u/Tomas_Law)
#### Post date: [January 17, 2018, 5:13pm UTC](https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865/3 "2018-01-17T17:13:42Z")
Hey Chris,
Doing that aggregation will count+1 everytime the URI "[google.com](http://google.com)" is accessed.
I only want to count it if it was the URI that was accessed last in a session.
Thanks for the reply.
---
### Author:  [@Tomas\_Law](https://discuss.elastic.co/u/Tomas_Law)
#### Post date: [January 18, 2018, 4:01am UTC](https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865/4 "2018-01-18T04:01:09Z")
So far, I've managed to obtain the following table where the last visited URI's are selected.
What I need now is to group those last 2 URI's and compute the count for each of them.
Therefore, the desired result is something like:
/www-org.empleo.gob.es/es/garantiajuvenil/accesoJovenes.html 2
/www-org.empleo.gob.es/fogasa/descripcion\_organigrama.html 1
/www-org.empleo.gob.es/fogasa/contacto.html 1
How can I group those URI's now?
---
### Author:  [@lukas](https://discuss.elastic.co/u/lukas)
#### Post date: [January 18, 2018, 6:13pm UTC](https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865/5 "2018-01-18T18:13:07Z")
I don't think we can get you all of the way there in Kibana, but we can get you pretty close 🙂
1. Under Metrics, select "Top Hit". For the "Field", select cs\_uri.keyword. For the "Sort On", select timestamp.
2. Under Buckets, select "Split Rows". For the aggregation, select "Terms" and for the "Field" select session\_id.keyword.
This will give you a list of all of the last cs\_uris for each session\_id. Unfortunately, that's the best we can do (that I can figure), but you could export it as CSV, import to something like Excel, and manually compute the count.
---
### Author:  [@Tomas\_Law](https://discuss.elastic.co/u/Tomas_Law)
#### Post date: [January 19, 2018, 3:54pm UTC](https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865/6 "2018-01-19T15:54:37Z")
Hey Lukas,
The solution you proposed does get me the list of all of the last cs\_uris for each session\_id.
I've come up with a (better but not complete) solution where I manage to get the count split by tables but I can't order them.
The link to the post with the split table aggregation is:
> [@Data Table with split table ordering](https://discuss.elastic.co/t/data-table-with-split-table-ordering/116030):
>
> Hello, After a couple split rows and split tables aggregations I get the following result: The most important metric I get comes from the Total function in the visualization Options which is the Sum (circled in red). I want to order the splitted tables according to the sum value (left: highest sum- \>right: lowest sum) but I don't know how to use this Sum value to order them. [image] How can I do it? Thank you
Thanks for replying!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2018, 3:54pm UTC](https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865/7 "2018-02-16T15:54:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.