How to get latest entry for all users

Elastic Stack Kibana
1

I am using elasticsearch as database and kibana 4.0 for view analytics.

What query to use to search for latest client status in kibana 4 discover page. Below is my input data

Documents in kibana:
{ClientIP:10.10.10.10,Status:NotWorking,TimeStamp:12-Aug-2015}
{ClientIP:20.20.20.20,Status:Working,TimeStamp:12-Aug-2015}
{ClientIP:10.10.10.10,Status:NotWorking,TimeStamp:13-Aug-2015}
{ClientIP:10.10.10.10,Status:Working,TimeStamp:14-Aug-2015}
{ClientIP:30.30.30.30,Status:NotWorking,TimeStamp:12-Aug-2015}
{ClientIP:30.30.30.30,Status:Working,TimeStamp:16-Aug-2015}
{ClientIP:20.20.20.20,Status:Working,TimeStamp:10-Aug-2015}
{ClientIP:20.20.20.20,Status:NotWorking,TimeStamp:18-Aug-2015}

Expected Result :
{ClientIP:10.10.10.10,Status:Working,TimeStamp:14-Aug-2015}
{ClientIP:20.20.20.20,Status:NotWorking,TimeStamp:18-Aug-2015}
{ClientIP:30.30.30.30,Status:Working,TimeStamp:16-Aug-2015}

2

I believe this will require support for the top_hits aggregation in Kibana. Please feel free to comment on this issue, if this use case is important to you:

3

Thanks for your reply.
One more thing, is it possible to write DSL or custom filter/agg queries in kibana.??

4

You can paste the filter portion of query DSL (with some restrictions), right into the Kibana 4 search bar. However, not aggregations.

See this discussion for an example: Where to add a missing filter in this Kibana search