Hi I need to get the max of memory usage per host in a time range, I think I can do this with the query below, but I also need the @timestamp of the document when the max memory usage happens. how can I do this? GET memory-*/_search { "size": 0, "query": { "bool": { "filter": [ …

Another way is top_hits which gives the whole document of the with the max value. GET metricbeat-*/_search { "size": 0, "query": { "bool": { "filter": [ { "exists": { "field": "cloudfoundry.container.cpu.pct" } }, { "ra…

Discuss the Elastic Stack

Get the @timestamp of the document that has the max of a value

Elastic Stack Elasticsearch

Badger November 24, 2021, 5:36pm 2

You should move this to the Elasticsearch forum.

1 Like

Topic		Replies	Views
Need @timestamp value where the maximum aggregation result occurred Elasticsearch	2	676	November 5, 2020
Elasticsearch: aggregation and select docs only having max value of field Elasticsearch	3	2899	August 28, 2019
Term query (max) timestamp question Elasticsearch	7	3652	January 16, 2019
How to query for "max" value? Elasticsearch	4	540	July 5, 2017
ElasticSearch Max of Max? Elasticsearch	3	731	March 2, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Get the @timestamp of the document that has the max of a value

Related topics