Display data with the latest date

[jazzdorf]

Hi,

I'm new to Kibana and I'm trying out some things.
Now, I have some dummy data set and I want to filter for some data by a query. How can I get a count for the latest date where data exists?

I'm using a metric visualization, I've picked "Count" as aggregation and a filter in a split group bucket with the following query:

id: *Kunfu* and not links.id : *

is there something like:

id: *Kunfu* and not links.id : * and date : max() ?

I'm using Kibana 7.8

Help is very much appreciated.

[AClerk]

Hi,
Try using top_hits.
Cheers!

[jazzdorf]

Hi AClerk,

I was trying to, but then it displays only one ID and not the aggregated count from that day.
Is there a way to get the count from the latest day? And if so how?

Help is very much appreciated.

[AClerk]

Please provide sample data and the required outcome.
It will help me, and others, to assist you.
Cheers!

[jazzdorf]

HI AClerk,

thank you and of course.

Data looks like this:

{
  "_index": "debug_sample_data",
  "_type": "_doc",
  "_id": "w0K42XcBYzpkMbM6kDBv",
  "_version": 1,
  "_score": null,
  "_source": {
    "datum": "2021-01-11",
    "id": "dummy_Kunfu_C_0",
    "links": [
      {
        "id": "Kunfu_C_Link_0"
      }],
    "tests": [
      {
        "id": "Kunfu_C_Test_0"
      }]
},
  "fields": {
    "datum": [
      "2021-01-11T00:00:00.000Z"
    ]
  },
  "highlight": {
    "id": [
      "@kibana-highlighted-field@dummy_Kunfu_C_0@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1610323200000
  ]
}

The outcome is this:

And looking at the data I see that there are two date fields called "datum". Might this have something to do with my problem?

[AClerk]

Sorry, but I did not understand.
How does your index look like?
Provide field:value sample of 3-4 docs.
Then provide the required doc you want to fetch.
Cheers!