Find first occurrence and last occurrence of an id

#1

Hi,

Is there a way to find the first occurrence of a field and the last occurrence of a field?

My requirement is this:

  1. Get the timestamp of the first occurance of id field '123'
  2. Get the timestamp of the last occurance of id field '123'
  3. Return all logs between the first and last timestamp
#2
  1. Search for id 123 and have ES sort by the timestamp field in ascending order, grab the first hit.
  2. Same as above but sort in descending order.
  3. Do a range query with the timestamps received in previous steps.
#3

Thanks, Is there a way to script this however passing the id as parameter.
I'd like to have a Saved Search query that I can reuse and pass the id to it.

#4

Oh, you want it done in Kibana. I don't think there's a convenient way of doing that at the moment.

#5