Date with the max count grouped by a term

[crimson589]

I'm currently getting this results

message1 | 2022-06-09 | 250
message1 | 2022-06-08 | 300
message2 | 2022-06-09 | 400
message2 | 2022-06-08 | 200

And my current setting is like this

What do I need to add here to just get the dates with the highest count like tis

message1 | 2022-06-08 | 300
message2 | 2022-06-09 | 400

[bhavyarm]

Hello,

So your interval is daily and you are seeing results for that. I am not sure how to tweak this? I will buzz you back.

Thanks,
Bhavya

[Tomo_M (Tomohiro Mitani)]

There is no such function to filter date histogram buckets.

One option is to create a runtime field to calculate the date of @timestamp and then use terms aggregation with size 1 on that runtime field.