# FIRST() & LAST() SQL Aggregate functions returns parsing\_exception

**URL:** https://discuss.elastic.co/t/first-last-sql-aggregate-functions-returns-parsing-exception/213071
**Category:** Elasticsearch
**Created:** [December 26, 2019, 11:57am UTC](https://discuss.elastic.co/t/first-last-sql-aggregate-functions-returns-parsing-exception/213071 "2019-12-26T11:57:24Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![macarop](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@macarop](https://discuss.elastic.co/u/macarop)
#### Post date: [December 26, 2019, 11:57am UTC](https://discuss.elastic.co/t/first-last-sql-aggregate-functions-returns-parsing-exception/213071/1 "2019-12-26T11:57:24Z")

</div>

Hello

I try to get the lastest value of a parameter using the LAST aggregation function

> ```
> {
> "query": "SELECT LAST(system.uptime.duration.ms, \"@timestamp\") from \"metricbea*\" where host.name='titi' "
> }
> 
> ```

This returns

> {  
> "error": {  
> "root\_cause": [  
> {  
> "type": "parsing\_exception",  
> "reason": "line 1:10: extraneous input 'last' expecting {'(', 'ANALYZE', 'ANALYZED', 'CAST', 'CATALOGS', 'COLUMNS', 'CONVERT', 'DEBUG', 'EXECUTABLE', 'EXISTS', 'EXPLAIN', 'EXTRACT', 'FALSE', 'FORMAT', 'FUNCTIONS', 'GRAPHVIZ', 'LEFT', 'MAPPED', 'MATCH', 'NOT', 'NULL', 'OPTIMIZED', 'PARSED', 'PHYSICAL', 'PLAN', 'RIGHT', 'RLIKE', 'QUERY', 'SCHEMAS', 'SHOW', 'SYS', 'TABLES', 'TEXT', 'TRUE', 'TYPE', 'TYPES', 'VERIFY', '{FN', '{D', '{T', '{TS', '{GUID', '+', '-', '_', '?', STRING, INTEGER\_VALUE, DECIMAL\_VALUE, IDENTIFIER, DIGIT\_IDENTIFIER, QUOTED\_IDENTIFIER, BACKQUOTED\_IDENTIFIER}"  
> }  
> ],  
> "type": "parsing\_exception",  
> "reason": "line 1:10: extraneous input 'last' expecting {'(', 'ANALYZE', 'ANALYZED', 'CAST', 'CATALOGS', 'COLUMNS', 'CONVERT', 'DEBUG', 'EXECUTABLE', 'EXISTS', 'EXPLAIN', 'EXTRACT', 'FALSE', 'FORMAT', 'FUNCTIONS', 'GRAPHVIZ', 'LEFT', 'MAPPED', 'MATCH', 'NOT', 'NULL', 'OPTIMIZED', 'PARSED', 'PHYSICAL', 'PLAN', 'RIGHT', 'RLIKE', 'QUERY', 'SCHEMAS', 'SHOW', 'SYS', 'TABLES', 'TEXT', 'TRUE', 'TYPE', 'TYPES', 'VERIFY', '{FN', '{D', '{T', '{TS', '{GUID', '+', '-', '_', '?', STRING, INTEGER\_VALUE, DECIMAL\_VALUE, IDENTIFIER, DIGIT\_IDENTIFIER, QUOTED\_IDENTIFIER, BACKQUOTED\_IDENTIFIER}"  
> },  
> "status": 400  
> }

I am probably missing something but cannot make it through.  
Please help

---

<div class="post-metadata">

### Author: ![Andrei\_Stefan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrei_stefan/32/47533_2.png) [@Andrei\_Stefan](https://discuss.elastic.co/u/Andrei_Stefan)
#### Post date: [December 27, 2019, 11:38am UTC](https://discuss.elastic.co/t/first-last-sql-aggregate-functions-returns-parsing-exception/213071/2 "2019-12-27T11:38:44Z")

</div>

@macarop judging by the error, I think you are using `LAST` in an ES version where it didn't exist? What ES version are you using?  
For the reference, it's been added in 6.7.0 and 7.0.0.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 24, 2020, 11:38am UTC](https://discuss.elastic.co/t/first-last-sql-aggregate-functions-returns-parsing-exception/213071/3 "2020-01-24T11:38:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.