Extract Max value of build number from result and use it in filter value

[Ajinkya_Sabale]

I want to extract Max build_number from following and apply filter on that max. build number.

Query in dev tools-
GET logstash-report-2017.10.13/_search?filter_path=hits.hits._source.build_number

Result is -

{
"hits": {
"hits": [
{
"_source": {
"build_number": "271278"
}
},
{
"_source": {
"build_number": "271317"
}
},
{
"_source": {
"build_number": "271317"
}
},
{
"_source": {
"build_number": "271317"
}
},
{
"_source": {
"build_number": "271317"
}
},
{
"_source": {
"build_number": "271317"
}
},
{
"_source": {
"build_number": "271278"
}
},
{
"_source": {
"build_number": "271278"
}
},
{
"_source": {
"build_number": "271278"
}
},
{
"_source": {
"build_number": "271278"
}
}
]
}
}

[Ajinkya_Sabale]

I got max value from this query, but how to use this in visualizations buckets ?

GET logstash-report-2017.10.13/_search
{
"aggs" : {
"max_id" : { "max" : { "field" : "build_number" } }
}
}

[Bargs (Matt Bargar)]

Right now there's no way to create a query that uses the results of a previous request in an automated fashion. Those sorts of multi-stage queries are something we'd like to explore in the future.

If you just want to create a bucket for the max build number that you can then add sub-buckets to, you might be able to hack this together.

Create a new vis with a "Max build_number" metric on the y-axis. Create a "Split Chart" bucket with a terms agg of size 1 on the build_number field, ordered by the max metric. Now add whatever additional metrics and buckets you want. I think that's about as close as you'll get currently. See example below.