Create a table showing two "sibling" elements

[rgahan5c]

I have data that is in the form:

{
  user_email: "test@example.com",
  number_of_emails_sent: 100,
  ...
}

I would like to display it in a table like:

User Email	Number of Emails Sent
test@example.com	100

I have tried to do it via Data Table visualization, as well as in TSVB, to no avail. Is this possible?

As a bonus question, I will get one document for each user every day. Is there a way to make the visualization only utilize the most recent document associated with the user? Or would you handle that via time filters?

[bhavyarm]

Hi,

You should take a look at lens and its definitely possible Kibana Lens | Elastic

I would say handling the most recent document via timepicker is the easiest way to go. You can also save the search or the dashboard with timepicker for the last time period in which case every time you open it - you will open it for your needed time period.

Thanks
Bhavya

[rgahan5c]

When I use Lens, I can make a table laid out like:

Top values of user_email.keyword	Top values of number_of_emails_sent.keyword	Count of records

When what I'm looking for is:

User Email	Number of Emails Sent
test@example.com	100
And so on each user

Is that possible, either in Lens or another tool?

[ghudgins (Graham Hudgins)]

Try using the "Last value" for your number of emails sent instead of a count of records as the metric.

[rgahan5c]

Where might I find that option in Lens? I don't see it when I click on the number of emails sent column in the section on the right of the screen

UPDATE:
I changed the grouping to both overall top and then top value for each, and neither of them gave what I was looking for. Additionally, when I removed the "count of records" column, the table doesn't display any data.

[ghudgins (Graham Hudgins)]

try moving "number of emails sent" to "metric" instead of column

[rgahan5c]

I am running Kibana 7.7.1, is this feature available for that version? I don't see that option when looking at the Lens page.

[ghudgins (Graham Hudgins)]

ah, yeah. it's not available in Lens in 7.7 and unfortunately "Top Hits" isn't available in non-Lens data tables either in your version.

you could do a non-Lens vertical / horizontal bar chart set up to "Top Hits" (same aggregation Lens' "Last Value" uses)