# Get last document string value in each bucket

**URL:** https://discuss.elastic.co/t/get-last-document-string-value-in-each-bucket/260013
**Category:** Elasticsearch
**Created:** [January 2, 2021, 11:33am UTC](https://discuss.elastic.co/t/get-last-document-string-value-in-each-bucket/260013 "2021-01-02T11:33:50Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)
#### Post date: [January 2, 2021, 4:43pm UTC](https://discuss.elastic.co/t/get-last-document-string-value-in-each-bucket/260013/2 "2021-01-02T16:43:27Z")

</div>

Sounds like a “last known state” type of problem.  
This is normally best solved by building an entity-centric index from your log index. This can be done using the transform api and requires [some scripting](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-painless-examples.html#painless-top-hits) to record the last known state for each entity.

---

_[View the full topic](https://discuss.elastic.co/t/get-last-document-string-value-in-each-bucket/260013)._