Display latest value in a `Bucket`

[grra (Ralf)]

Hey,
Let's say I have a set of numbers, and every minute another incremented number appears in my data. Now in Buckets I would like to visualize the highest 20 values of that set of numbers, but in ascending order. That happens in a aws instance of Kibana.
How is it possible to do that?

E.g. if I have a document numbers with values like {1, 2, 3, 4, 5, 6, 7, 8, 9, 10}..
And in my dashboard I want to show the latest 5 numbers in Buckets like {5, 6, 7, 8, 9, 10}. (ascending order)

[wylie (Wylie Conlon)]

Thanks for the extra detail- I can try to give more possibilities, but I need to make some assumptions because you haven't described what visualization you would like. I am going to assume that you want this in a table, because you've only described one dimension.

It sounds like the "largest 20 values" is the same thing as "last 20 values" in your data. This gives you a lot more flexibility. Here are the options I can think of:

1. You can create a Saved Search from the Discover app, which is a table based on individual documents. You can change the sort order of the columns, for example you can sort the numbers in ascending order, but it will sort all the values in the time range, there is no way to limit to 20 values. I think this solves your use case if you set the time range to 20 minutes.

2. You can use the "Top hits" aggregation as a Metric, not a bucket inside the data table visualization:

3. You can use Vega, like I described in the previous thread.

[grra (Ralf)]

Thanks for the quick reply.

Sorry, I forgot to mention:
I would like to create a Line Graph Visualization, with "metrics": "ram_usage" on the y-Axis and the corresponding build_numbers as buckets on the x-Axis.

Also I would like to achieve that without any timestamps.

1. I already created a Saved Search from Discover app, where I get the Build_Numbers in a descending Order.
   What I am missing, is to display the 20 biggest numbers in an ascending order.

2. I can not use the Top-Hit Aggregation. Because the Line Graph does not provide that.

3. I did not try to use Vega yet, because I thought the limitations are quite the same.

[wylie (Wylie Conlon)]

Now that you've described the inputs and outputs that you want, I can give you a possible solution or a recommendation to use Vega. Your assumption about Vega is wrong: Vega is the solution if you need complete control.

If I understand correctly about your data, you might not need Vega. I think you can use the Visualize > Line chart builder. Set your metric on the Y axis. On the X axis, choose Terms of build_numbers. Choose the sort order to be Custom Metric. The metric is Max of timestamp, sorted in ascending order. The size is 20.

The result of this chart is that the buckets on the X axis will show the 20 most recent build numbers, while the Y axis will show the metric based on each build.