# How to group documents and show latest document per group

**URL:** <https://discuss.elastic.co/t/how-to-group-documents-and-show-latest-document-per-group/351165>\
**Category:** Kibana\
**Created:** [January 16, 2024, 12:30pm UTC](https://discuss.elastic.co/t/how-to-group-documents-and-show-latest-document-per-group/351165 "2024-01-16T12:30:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrusch](https://avatars.discourse-cdn.com/v4/letter/m/76d3ee/32.png) [@mrusch](https://discuss.elastic.co/u/mrusch)\
**Post date:** [January 16, 2024, 12:30pm UTC](https://discuss.elastic.co/t/how-to-group-documents-and-show-latest-document-per-group/351165/1 "2024-01-16T12:30:55Z")

</div>

Scenario: We have a third party tool for server patching and it sucks when it comes to reporting. So I want to build a dashboard in Kibana which shows patch status of thousands of servers.

Available data so far per server: Hostname, Operation System, scan run identifier, scan run date, list of missing patches, number of missing patches

Scans run in different batches across all servers, so there are multiple scans which show the current status. You have to combine these runs to see the whole current picture for all servers.

One thing I want to display in Kibana: Number of missing patches in last scan run across all servers. The number of servers is dynamic and not fix, because some new VMs are created and some old ones destroyed every day

Question: Should I try to create buckets for each server with a formula and function „terms“ by using „hostname“? This will lead to many thousands of buckets over time and I‘m concerned about performance. Or can I also get the latest document per server in another way without „terms“ function? The hard thing is that the scans run unpredictable and not at fixed times per day.

Any thoughts how to work with this?

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [February 2, 2024, 4:52pm UTC](https://discuss.elastic.co/t/how-to-group-documents-and-show-latest-document-per-group/351165/2 "2024-02-02T16:52:47Z")

</div>

Have you checked Transforms and the "Latest Transforms" variant?

> **[Transform overview | Elasticsearch Guide \[8.12\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.12/transform-overview.html#latest-transform-overview)**

With transforms, you can automatically generate a side index that contains only the last document for each server and, with that, perform any aggregations and reporting you need.

---

<div class="post-metadata">

**Author:** ![mrusch](https://avatars.discourse-cdn.com/v4/letter/m/76d3ee/32.png) [@mrusch](https://discuss.elastic.co/u/mrusch)\
**Post date:** [February 2, 2024, 7:55pm UTC](https://discuss.elastic.co/t/how-to-group-documents-and-show-latest-document-per-group/351165/3 "2024-02-02T19:55:11Z")

</div>

That sounds very promising. I reach out to our platform admins if they have any concerns with it.  
Thanks a lot for this hint

In case they have objections.. do you have another idea how to tackle this problem?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2024, 7:55pm UTC](https://discuss.elastic.co/t/how-to-group-documents-and-show-latest-document-per-group/351165/4 "2024-03-01T19:55:32Z")

</div>

Closed on March 1, 2024, 7:55pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.