How to aggregate by value and get latest results

Elastic Stack Kibana
1

Hi,
I am trying to build a table visualisation to show all clusters in storage.
In my specific example, I am expecting to have only 2 clusters, as there are only 2 unique cluster IDs.
I am not able to aggregate and get the latest results only.
How should that be done?
I tried by

Metric Aggregation: Top Hit
Field: Cluster_id
Aggregate with: concatenate
Size: 1
Sort on: @timestamp
Order: Descending

Also tried to get MAX timestamp, and all kind of try and error, with no luck.

Currently, the records are duplicated, and I don't know why.
I would like to see the records marked in red and only those.

89%20-%20Remote%20Desktop%20Connection
89%20-%20Remote%20Desktop%20Connection2097×389 10.2 KB

Cheers!

2

What are you using for the split in the table? It should work with a Terms aggregation on the cluster ID field.

3

@Marius_Dragomir
Not sure I understand the question.
I split the table with the properties I want to show.

Anyhow,
For now, my workaround/solution is to take the Max timestamp of the doc.
Then Split the table with the fields to show and aggregate by Max(timestamp)
Seems to work for now.

Cheers!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.