# Data table of last event for property that contains objects in an array

**URL:** <https://discuss.elastic.co/t/data-table-of-last-event-for-property-that-contains-objects-in-an-array/180549>\
**Category:** Kibana\
**Created:** [May 10, 2019, 11:53am UTC](https://discuss.elastic.co/t/data-table-of-last-event-for-property-that-contains-objects-in-an-array/180549 "2019-05-10T11:53:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![raged](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raged/32/45722_2.png) [@raged](https://discuss.elastic.co/u/raged)\
**Post date:** [May 10, 2019, 11:53am UTC](https://discuss.elastic.co/t/data-table-of-last-event-for-property-that-contains-objects-in-an-array/180549/1 "2019-05-10T11:53:33Z")

</div>

Hello,

I am trying to format the following event into a data table that just shows me the last data point (top hit) of a property that contains several objects in one property that is an array.

Here is the JSON:

```
  "Win32_quickfixengineering": [
    {
      "HotFixID": "KB4489192",
      "InstalledOn": "4/12/2019",
      "InstalledBy": "NT AUTHORITY\\SYSTEM",
      "Description": "Update"
    },
    {
      "HotFixID": "KB4480056",
      "InstalledOn": "4/22/2019",
      "InstalledBy": "NT AUTHORITY\\SYSTEM",
      "Description": "Update"
    },
    {
      "HotFixID": "KB4493478",
      "InstalledOn": "4/12/2019",
      "InstalledBy": "NT AUTHORITY\\SYSTEM",
      "Description": "Security Update"
    },
    {
      "HotFixID": "KB4493510",
      "InstalledOn": "4/12/2019",
      "InstalledBy": "NT AUTHORITY\\SYSTEM",
      "Description": "Security Update"
    },
    {
      "HotFixID": "KB4493509",
      "InstalledOn": "4/12/2019",
      "InstalledBy": "NT AUTHORITY\\SYSTEM",
      "Description": "Security Update"
    }
  ]
},

```

I have tried several things, but I can't quite get it right:

 ![OUTLOOK_gS1D04gH9M](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af7a58eba650ddac8689ae342713bab6434ecdee.png)

 ![OUTLOOK_yfk4LOxtPF](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11b746fbaf32b4f51391b8cbebbb3d2a4344058a.png)

I want to mimic this data table:

![OUTLOOK_oSEsKNaNNJ](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d3e3d661673acc598dfbaf4791b97ce8addd0284.png)

Can someone please help?

Thanks

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [May 13, 2019, 7:16pm UTC](https://discuss.elastic.co/t/data-table-of-last-event-for-property-that-contains-objects-in-an-array/180549/2 "2019-05-13T19:16:17Z")

</div>

I'm not sure if this is possible.

Is it possible to reindex this data so that each individual element in that array is an actual individual document?

---

<div class="post-metadata">

**Author:** ![raged](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raged/32/45722_2.png) [@raged](https://discuss.elastic.co/u/raged)\
**Post date:** [May 13, 2019, 8:06pm UTC](https://discuss.elastic.co/t/data-table-of-last-event-for-property-that-contains-objects-in-an-array/180549/3 "2019-05-13T20:06:00Z")

</div>

Are you saying if I post this data 5 separate times to logstash I would be able to show that data like it is presented in the black box above?

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [May 13, 2019, 8:08pm UTC](https://discuss.elastic.co/t/data-table-of-last-event-for-property-that-contains-objects-in-an-array/180549/4 "2019-05-13T20:08:22Z")

</div>

Yes, it would just be a saved-search then [https://github.com/elastic/kibana/issues/4707](https://github.com/elastic/kibana/issues/4707)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2019, 8:08pm UTC](https://discuss.elastic.co/t/data-table-of-last-event-for-property-that-contains-objects-in-an-array/180549/5 "2019-06-10T20:08:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.