How to keep the latest row in kibana data table?

[Abdul_Gaffar_Shaikh]

Hi,

Basically i am trying to show URLs status with response code and hostname in a DataTable with 15 minute interval which refreshes after every 10 secs.
the above scenario is achieved, however if a service goes down and comes up in a interval less than 15 minutes, 2 records of same URL displays with status up and down.
So how to avoid such scenario and show only latest URL status ?

status	Host Machine	URL to Monitor	Response code(200:Ok & hypen:Unavailable)
down	Machine1	http://localhost:8080	-
down	Machine1	http://localhost:9200	503
up	Machine1	http://localhost:8080	200
up	Machine1	http://localhost1:8088	200
up	Machine1	http://localhost1:9995	200
up	Machine1	http://localhost2:8083	200
up	Machine1	http://localhost2:8080	200

as you can see in the above table , the URL localhost:8080 is displayed twice one with status - and other with 200.

Note :- This graph need to be embedded in a dashboard where the interval and frequency of refresh has to be constant.

[cjcenizal]

Hi there, could you show me a screenshot of what your metrics aggregation looks like?

Thanks,
CJ

[Abdul_Gaffar_Shaikh]

Please have a look.

[cjcenizal]

First, let's structure your visualization to surface the value you care about, which is status. It looks like your Metrics aggregation is on the status field which is what we want. But instead of "Max" let's use "Top hit" sorted on your time field (descending), which will return the most recent document. This will show only the latest URL status.

Then I think you can add another Metrics aggregation for the response code, again using "Top hit" sorted on time field (descending).

Lastly, I think you only need one bucket aggregation. Specifically, a "Terms" aggregation on the "ScriptedURL" field. This is important because it means we're using this field as the "key", i.e. they unique identifier for each row in the data table.

Does this work for you? If not, we may need to make some adjustments based on how your documents are structured.

Thanks,
CJ

[Abdul_Gaffar_Shaikh]

Thanks @cjcenizal. This resolves my problem.