# Find newly added Event that have a unique ID
**URL:** https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690
**Category:** Kibana
**Created:** [June 22, 2021, 6:33pm UTC](https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690 "2021-06-22T18:33:41Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Zentas](https://discuss.elastic.co/u/Zentas)
#### Post date: [June 22, 2021, 6:33pm UTC](https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690/1 "2021-06-22T18:33:41Z")
Hello, is there any existing feature or way to do this?
I need to see Data that has been newly added (fresh ID) in a specific time frame.
Example:
Time 12:00
Data:
Ex 1 - ID: 1 - Name: ...
Ex 2 - ID: 2 - Name: ...
Ex 3 - ID: 3 - Name: ...
Time 12:05
Data:
Ex 1 - ID: 1 - Name: ...
Ex 2 - ID: 2 - Name: ...
Ex 3 - ID: 3 - Name: ...
Ex 4 - ID: 4 - Name: ...
Ex 5 - ID: 5 - Name: ...
How can I make it, so if i choose the time 12:05 and only want to see the difference of the previous time to see this:
Time 12:05 (Difference)
Data:
Ex 4 - ID: 4 - Name: ...
Ex 5 - ID: 5 - Name: ...
There exists multiple ways to show Serial Diff of events via a unique ID - but it would only show the number 2 in my shown example. I need to see these 2 Ex files with all their attributes and not how many of them are different.
Thank you in advance!
---
### Author:  [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)
#### Post date: [June 22, 2021, 7:20pm UTC](https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690/2 "2021-06-22T19:20:27Z")
You could implement this using a [continuous transform](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html). As `group_by` you can use the `id` and in the `aggregation` part use a `min(timestamp)` to write a `first_seen` field. Given this field you can query on the dest index for what you are aiming for.
To copy all other fields you can use [something like this](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-painless-examples.html#painless-top-hits).
Note: If your dataset is small you might also do this via ordinary search+aggs, but I assume you have larger volumes, that's why I suggest transform.
---
### Author:  [@Zentas](https://discuss.elastic.co/u/Zentas)
#### Post date: [June 22, 2021, 11:49pm UTC](https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690/3 "2021-06-22T23:49:31Z")
Thank you for pointing me in that direction, i will have a look and try to implement this.
By the sounds of it, this will then timestamp an ID if it has been appeared to be then filtered and searched for.
Is there also a solution for the reverse of it? To see which unique id is not to be seen anymore?
Like this:
Time 12:00
Ex 1 - ID 1 - Name ..
Ex 2 - ID 2 - Name ..
Ex 3 - ID 3 - Name ..
Time 12:05
Ex 1 - ID 1 - Name ..
Ex 3 - ID 3 - Name ..
to get this result -\>
Time 12:05(disappeared)
Ex 2 - ID 2 - Name ..
---
### Author:  [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)
#### Post date: [June 23, 2021, 6:15am UTC](https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690/4 "2021-06-23T06:15:03Z")
Similar concept, if you add an aggregation with `max(timestamp)` written to a field e.g. `last_seen` you can query for id's that disappeared.
You can automatically delete those entries using the `retention_policy` feature, however than you won't be able to query for disappeared id's obviously.
---
### Author:  [@Zentas](https://discuss.elastic.co/u/Zentas)
#### Post date: [June 23, 2021, 2:25pm UTC](https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690/5 "2021-06-23T14:25:34Z")
Thank you for now, I will get back to you to tell you how it went! 😀
---
### Author:  [@Zentas](https://discuss.elastic.co/u/Zentas)
#### Post date: [June 28, 2021, 6:10pm UTC](https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690/6 "2021-06-28T18:10:29Z")
Thank you, This solved my original question.
It seems like It's not the full solution that I need and I need to look deeper into this and research myself first.
Thank you again for taking your time to help me!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 26, 2021, 6:10pm UTC](https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690/7 "2021-07-26T18:10:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.