How to aggregate by value and get latest results

I am trying to build a table visualisation to show all clusters in storage.
In my specific example, I am expecting to have only 2 clusters, as there are only 2 unique cluster IDs.
I am not able to aggregate and get the latest results only.
How should that be done?
I tried by

Metric Aggregation: Top Hit
Field: Cluster_id
Aggregate with: concatenate
Size: 1
Sort on: @timestamp
Order: Descending

Also tried to get MAX timestamp, and all kind of try and error, with no luck.

Currently, the records are duplicated, and I don't know why.
I would like to see the records marked in red and only those.


What are you using for the split in the table? It should work with a Terms aggregation on the cluster ID field.

Not sure I understand the question.
I split the table with the properties I want to show.

For now, my workaround/solution is to take the Max timestamp of the doc.
Then Split the table with the fields to show and aggregate by Max(timestamp)
Seems to work for now.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.