How to get transaction id the greatest value elastic

Hi,

I have around 5 logs per transaction, every log has a timestamp and all 5 logs in a transactionId has a unique Id
I am trying to find the latest (largest) timestamp for every transaction Id.

Many thanks

The challenge is the high cardinality field that needs grouping on.
You can use aggregations to do this but will likely need to break it down into chunks using this partitioning approach

Alternatively you can use more of a streaming API to periodically sort the latest log raw records and compact down into an entity-centric index (the entity in your case being a transaction).

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.