Is it possible to update an old event already stored?

Elastic Stack Logstash
1

Hi,

I would like to visualize if a server is in status ok, warning, critical. So I have events which have a field which contains this information.

But how can I show only the latest probe / event?

Is it possible to update events which are alraady stored in elastic search? If so, I could delete a flag "latest" from old requests in es and set it for the current event.

In the dashboard I could query for the tag "latest".

Thanks,
Andreas

2

Is it possible to update events which are alraady stored in Elasticsearch?

If you have a stable document id you can certainly update it with the elasticsearch output.

If so, I could delete a flag "latest" from old requests in es and set it for the current event.

That sounds like a bad idea. Why not just add events as you please and query ES for the most recent event to get the current status?

3

Thats what I wanted to do first, but I did not found out how to do it.

How can I get the most recent event event in kibana? unfortunately i have to deal with kibana 3 and es 1.6

4

Sorry, I don't remember enough of Kibana 3. Wasn't there a panel for displaying a single value?