How to get transaction id the greatest value elastic

Elastic Stack Elasticsearch
1

Hi,

I have around 5 logs per transaction, every log has a timestamp and all 5 logs in a transactionId has a unique Id
I am trying to find the latest (largest) timestamp for every transaction Id.

Many thanks

2

The challenge is the high cardinality field that needs grouping on.
You can use aggregations to do this but will likely need to break it down into chunks using this partitioning approach

Alternatively you can use more of a streaming API to periodically sort the latest log raw records and compact down into an entity-centric index (the entity in your case being a transaction).

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.