How to get the max timestamp of an elastic search index?

Elastic Stack Elasticsearch
1

Hi,

I have this requirement to verify the gap between logstash and elasticsearch processing .
For this , I need to get the max timestamp of the recent index entry.

Any input from the community regrading this ?

2

Run a max aggregation on the @timestamp field.

3

Thanks for the update.

The output is showing all the metadata , how can I remove the metadata just to get the required value string .
Say :slight_smile:

curl -XGET "http://localhost:9200/xyzindexpattern-*/_search?size=0" -H 'Content-Type: application/json' -d'

{
"aggs": {
"max_timestamp": {
"max": {
"field": "@timestamp"
}
}
}
}'
{"took":171,"timed_out":false,"_shards":{"total":135,"successful":135,"skipped":0,"failed":0},"hits":{"total":15841418,"max_score":0.0,"hits":},"aggregations":{"max_timestamp":{"value":1.527507651411E12,"value_as_string":"2018-05-28T11:40:51.411Z"}}}

in this I just need only "2018-05-28T11:40:51.411Z" should be displayed as the output.

4

I think you will need to parse it out from that response.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.