# Elasticsearch query to pull the record based on max timestamp
**URL:** https://discuss.elastic.co/t/elasticsearch-query-to-pull-the-record-based-on-max-timestamp/120131
**Category:** Logstash
**Created:** [February 16, 2018, 9:39am UTC](https://discuss.elastic.co/t/elasticsearch-query-to-pull-the-record-based-on-max-timestamp/120131 "2018-02-16T09:39:22Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@ranganath\_nangineni](https://discuss.elastic.co/u/ranganath_nangineni)
#### Post date: [February 16, 2018, 9:39am UTC](https://discuss.elastic.co/t/elasticsearch-query-to-pull-the-record-based-on-max-timestamp/120131/1 "2018-02-16T09:39:22Z")
Hi,
I have 4 records in the elasticsearch DB for the ddocname "CNT1882742" for the below query
# Logstash elasticsearch query:
query =\> '{ "query": {"match": { "ddocname" :"CNT1882742"} }, "sort": ["@timestamp"] }'
# Query output:
{"@timestamp":"2018-02-07T08:30:15.944Z","@version":"1","ddocname":"CNT1882742","ddoctitle":"VSNL\_R12Upgrade\_TECH\_UPG\_Resource\_Mix-DAA1\_V1.12.xls","did":4835074,"tags":["MYO Stage","data"]}
{"@timestamp":"2018-02-07T10:26:42.139Z","@version":"1","ddocname":"CNT1882742","ddoctitle":"VSNL\_R12Upgrade\_TECH\_UPG\_Resource\_Mix-DAA1\_V1.12.xls","did":4835074,"tags":["MYO Stage","data"]}
{"@timestamp":"2018-02-07T23:46:38.974Z","@version":"1","ddocname":"CNT1882742","ddoctitle":"VSNL\_R12Upgrade\_TECH\_UPG\_Resource\_Mix-DAA1\_V1.12.xls","did":4835074,"tags":["MYO Stage","data"]}
{"@timestamp":"2018-02-08T08:07:38.554Z","@version":"1","ddocname":"CNT1882742","ddoctitle":"VSNL\_R12Upgrade\_TECH\_UPG\_Resource\_Mix-DAA1\_V1.12.xls","did":4835074,"tags":["MYO Stage","data"]}
How to get only "one" record based on the "max timestamp" for the above. How to modify the query to achieve this ?
Expected output:
{"@timestamp":"2018-02-08T08:07:38.554Z","@version":"1","ddocname":"CNT1882742","ddoctitle":"VSNL\_R12Upgrade\_TECH\_UPG\_Resource\_Mix-DAA1\_V1.12.xls","did":4835074,"tags":["MYO Stage","data"]}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2018, 11:27am UTC](https://discuss.elastic.co/t/elasticsearch-query-to-pull-the-record-based-on-max-timestamp/120131/2 "2018-02-16T11:27:50Z")
Make sure the sorting on `@timestamp` is in descending order and set the plugin's `size` option to 1.
---
### Author:  [@ranganath\_nangineni](https://discuss.elastic.co/u/ranganath_nangineni)
#### Post date: [February 16, 2018, 1:11pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-pull-the-record-based-on-max-timestamp/120131/3 "2018-02-16T13:11:25Z")
It didnt work Magnusbaeck.
I tried this
query =\> '{ "query": {"match": { "ddocname" :"CNT1882742"} },"sort": {"@timestamp":{"order":"desc"}},"from":0,"size":1 }'
Still I m getting 4 results sorted based on timestamp in desc order.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2018, 1:44pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-pull-the-record-based-on-max-timestamp/120131/4 "2018-02-16T13:44:45Z")
I said "set the **plugin's** `size` option to 1". I didn't say anything about modifying the query.
---
### Author:  [@ranganath\_nangineni](https://discuss.elastic.co/u/ranganath_nangineni)
#### Post date: [February 16, 2018, 1:51pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-pull-the-record-based-on-max-timestamp/120131/5 "2018-02-16T13:51:39Z")
Sorry about that.
If you dont mind, Can you tell me how to change the plugin's size?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2018, 1:58pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-pull-the-record-based-on-max-timestamp/120131/6 "2018-02-16T13:58:35Z")
It's a plugin option, just like `query` that you're already using. See the plugin documentation.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2018, 1:58pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-pull-the-record-based-on-max-timestamp/120131/7 "2018-03-16T13:58:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.