# Find first occurrence and last occurrence of an id

**URL:** <https://discuss.elastic.co/t/find-first-occurrence-and-last-occurrence-of-an-id/36307>\
**Category:** Kibana\
**Created:** [December 3, 2015, 4:38pm UTC](https://discuss.elastic.co/t/find-first-occurrence-and-last-occurrence-of-an-id/36307 "2015-12-03T16:38:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![DK\_3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dk_3/32/48003_2.png) [@DK\_3](https://discuss.elastic.co/u/DK_3)\
**Post date:** [December 3, 2015, 4:38pm UTC](https://discuss.elastic.co/t/find-first-occurrence-and-last-occurrence-of-an-id/36307/1 "2015-12-03T16:38:52Z")

</div>

Hi,

Is there a way to find the first occurrence of a field and the last occurrence of a field?

My requirement is this:

1. Get the timestamp of the first occurance of id field '123'
2. Get the timestamp of the last occurance of id field '123'
3. Return all logs between the first and last timestamp

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 3, 2015, 8:09pm UTC](https://discuss.elastic.co/t/find-first-occurrence-and-last-occurrence-of-an-id/36307/2 "2015-12-03T20:09:47Z")

</div>

1. Search for id 123 and have ES sort by the timestamp field in ascending order, grab the first hit.
2. Same as above but sort in descending order.
3. Do a range query with the timestamps received in previous steps.

---

<div class="post-metadata">

**Author:** ![DK\_3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dk_3/32/48003_2.png) [@DK\_3](https://discuss.elastic.co/u/DK_3)\
**Post date:** [December 4, 2015, 12:27pm UTC](https://discuss.elastic.co/t/find-first-occurrence-and-last-occurrence-of-an-id/36307/3 "2015-12-04T12:27:02Z")

</div>

Thanks, Is there a way to script this however passing the id as parameter.  
I'd like to have a Saved Search query that I can reuse and pass the id to it.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 4, 2015, 6:29pm UTC](https://discuss.elastic.co/t/find-first-occurrence-and-last-occurrence-of-an-id/36307/4 "2015-12-04T18:29:06Z")

</div>

Oh, you want it done in Kibana. I don't think there's a convenient way of doing that at the moment.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:07pm UTC](https://discuss.elastic.co/t/find-first-occurrence-and-last-occurrence-of-an-id/36307/5 "2017-07-06T14:07:27Z")

</div>