# Duplicate session ID

**URL:** <https://discuss.elastic.co/t/duplicate-session-id/353877>\
**Category:** Elastic Search\
**Tags:** elastic-app-search\
**Created:** [February 22, 2024, 11:10am UTC](https://discuss.elastic.co/t/duplicate-session-id/353877 "2024-02-22T11:10:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mbrezzy](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@Mbrezzy](https://discuss.elastic.co/u/Mbrezzy)\
**Post date:** [February 22, 2024, 11:10am UTC](https://discuss.elastic.co/t/duplicate-session-id/353877/1 "2024-02-22T11:10:40Z")

</div>

Hi everyone, I have configured Fortigate to send logs to Elasticsearch. However, when there's a long live session, Fortigate creates a duplicate session ID every 2 minutes and consistently adds data size to the previous one. This results in inaccurate data being displayed in Elasticsearch.  
If anyone can help me to filtre network.bytes by the last duplicate session id

This is. A Duplicate session id

 ![IMG_3406](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af995e51b723c99ea03f7004a35edff8d592cae9.jpeg)

---

<div class="post-metadata">

**Author:** ![Kathleen\_DeRusso](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kathleen_derusso/32/132039_2.png) [@Kathleen\_DeRusso](https://discuss.elastic.co/u/Kathleen_DeRusso)\
**Post date:** [February 22, 2024, 1:18pm UTC](https://discuss.elastic.co/t/duplicate-session-id/353877/2 "2024-02-22T13:18:26Z")

</div>

I wonder if you could use the [sampler aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-sampler-aggregation.html) here on top of a terms aggregation by session ID. Then you could make sure to order by most recent?

---

<div class="post-metadata">

**Author:** ![Mbrezzy](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@Mbrezzy](https://discuss.elastic.co/u/Mbrezzy)\
**Post date:** [February 28, 2024, 12:34pm UTC](https://discuss.elastic.co/t/duplicate-session-id/353877/3 "2024-02-28T12:34:42Z")

</div>

Thank you but i tried this aggs  
{  
"size": 0,  
"aggs": {  
"unique\_sessions": {  
"terms": {  
"field": "session\_id.keyword",  
"size": 10,  
"order": {  
"latest\_event\_timestamp": "desc"  
}  
},  
"aggs": {  
"latest\_event\_timestamp": {  
"max": {  
"field": "@timestamp" //  
}  
},  
"latest\_event": {  
"top\_hits": {  
"size": 1,  
"sort": [  
{  
"@timestamp": {  
"order": "desc"  
}  
}  
]  
}  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2024, 12:35pm UTC](https://discuss.elastic.co/t/duplicate-session-id/353877/4 "2024-03-27T12:35:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.