# I want create a kibana table, combining the 2 latest documents grouped by a common field

**URL:** <https://discuss.elastic.co/t/i-want-create-a-kibana-table-combining-the-2-latest-documents-grouped-by-a-common-field/339937>\
**Category:** Kibana\
**Created:** [August 2, 2023, 12:04pm UTC](https://discuss.elastic.co/t/i-want-create-a-kibana-table-combining-the-2-latest-documents-grouped-by-a-common-field/339937 "2023-08-02T12:04:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MJohansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mjohansen/32/124230_2.png) [@MJohansen](https://discuss.elastic.co/u/MJohansen)\
**Post date:** [August 2, 2023, 12:04pm UTC](https://discuss.elastic.co/t/i-want-create-a-kibana-table-combining-the-2-latest-documents-grouped-by-a-common-field/339937/1 "2023-08-02T12:04:55Z")

</div>

Hey guys, I'm fairly new working with Kibana and the ELK stack.

I currently have logs being sent roughly every 12 hours, containing packages and their versions.

My goal, is to create a table that groups the data by their package.name field, and then display the timestamp and the package.version, of the 2 latest documents.

My first solution was making use of histograms, which gave me a useable table, but this solution has a downside to it. Because if I have a package updated outside of these 12 hour logging intervals, Lets say an package got updated at 16:00 the day before, my histogram table on a 12 hours, spread over a 24 hours duration ends up with 3 histogram rows.

where the rows would be split into 16:00, 00:00 and 12:00, because the outlier package update at 16:00 the day before i still inside the 24 hour window.

This lead me to looking into transforms, and here my question is, if there is anyone in the community that could point me towards a solution, where I could transform my data such that I take the two latest documents for each package.name and combine them keeping both timestamp and package.version fields? such that I could have a previous.package.version and current.package.version field and so on. on a single table row

Thanks in advance! 🙂

---

<div class="post-metadata">

**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\
**Post date:** [August 4, 2023, 5:05pm UTC](https://discuss.elastic.co/t/i-want-create-a-kibana-table-combining-the-2-latest-documents-grouped-by-a-common-field/339937/2 "2023-08-04T17:05:00Z")

</div>

Hi Mikkel. I found an example transform that can get the single latest value. Maybe you can modify it to return the latest two values?

> **[Painless examples for transforms | Elasticsearch Guide \[8.9\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-painless-examples.html#painless-top-hits)**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2023, 5:05pm UTC](https://discuss.elastic.co/t/i-want-create-a-kibana-table-combining-the-2-latest-documents-grouped-by-a-common-field/339937/3 "2023-09-01T17:05:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.