How to show one entry per day

[soad20000]

Hello,

I am on Elastic V8.10.4 and I have a dashboard for NTP that looks like this:

I want it to show only one entry per day, instead of multiple per day like it currently does. How can I accomplish this?

[abiliocastro]

Hi @soad20000 I think you have to aggregate by timestamp to accomplish what you want.

Now, you are showing TOP10 values for that day. For example: for the day 2023-12-08 there will be 10 entries for that day. Maybe if you show average values for the day you then will have one entry per day.

[soad20000]

I am not sure what you mean by aggregate by timestamp, could you clarify that for me please? I split the metrics by minimum value of timestamp, and I'm getting closer to what I want but not exactly. Also changed the number of values being shown from 10 to 2.

I want the dates to be in one single column.

[soad20000]

Ok I've managed to get it to look the way I want it to.

However, I noticed that the values are all the same in their respective categories across all dates. How can I make it use the exact value from the document? I see that the values are different in the documents.

It seems that it's taking the top value in that date range and using it for every row. If I change the date range to last 4 days the values change, same if I change it to the last 7 days too.

[abiliocastro]

Please show the last configuration of the table Rows and Metrics.
Maybe you have to inverse the things, put the @timestamp in the rows and the other fields in metrics using the top or last value. Did you get it?

I did an example of it:

[soad20000]

When I try to follow your example the fields values disappear.

Removing the timestamp shows the values again.

The last configuration I used was this:

[abiliocastro]

Did you select DateHistogram and marked Customize time interval and setted it to 1 day? When you tried to put the @timestamp field in the row?

[soad20000]

Yes it's currently set up like this:

[abiliocastro]

Now try to check if your query interval range is big enough to get the data

[soad20000]

It should be, I have it set to 1 month currently. Is this the query interval range you are referring to?

[soad20000]

Ahhhh nevermind I'm an idiot. I started collecting those logs a few days ago, so of course there is no data from before. I just had to scroll down