# Is there a way to do this directly in Kibana?

**URL:** https://discuss.elastic.co/t/is-there-a-way-to-do-this-directly-in-kibana/189993
**Category:** Kibana
**Created:** [July 11, 2019, 11:33am UTC](https://discuss.elastic.co/t/is-there-a-way-to-do-this-directly-in-kibana/189993 "2019-07-11T11:33:32Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Heij54](https://avatars.discourse-cdn.com/v4/letter/h/c4cdca/32.png) [@Heij54](https://discuss.elastic.co/u/Heij54)
#### Post date: [July 11, 2019, 11:33am UTC](https://discuss.elastic.co/t/is-there-a-way-to-do-this-directly-in-kibana/189993/1 "2019-07-11T11:33:32Z")

</div>

I am trying to get a list of users who has as their last activity "connect". Ideally, I want this as a metric viz or a data table in [Official](https://www.tellthebell.xyz/) Kibana showing the number of users that connected last and the list of them, respectively. I have, however, given up being able to do this in Kibana. I can get something similar directly from Elasticsearch using a terms aggregation followed by top\_hits as below. But the problem is, even though I am sorting the top\_hits by @timestamp, the resulting document in NOT the most recent.

```
    {
"size" : 0,
"sort": { "@timestamp": {"order": "desc"} },
"aggs" : {
    "by_user" : {
    "terms" : { 
            "field" : "fields.username.keyword",
            "size" : 1
        },
        "aggs": {
            "last_message": {
                "top_hits": {
                    "sort": [
                        {
                            "@timestamp": {
                                "order": "desc"
                            }
                        }
                    ],
                    "_source": {
                        "includes": ["fields.username.keyword", "@timestamp", "status"]
                    },
                    "size": 1
                }
            }
        }
        }
}
}

```

1. Is there a way to do this directly in Kibana?
2. How can I make sure top\_hits gives me the _latest_ results, rather than the "most relevant"?

---

<div class="post-metadata">

### Author: ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [July 18, 2019, 11:09am UTC](https://discuss.elastic.co/t/is-there-a-way-to-do-this-directly-in-kibana/189993/2 "2019-07-18T11:09:06Z")

</div>

That aggregation should display the latest results. Maybe asking in the Elasticsearch area about the query can get you some help in troubleshooting it

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 15, 2019, 11:09am UTC](https://discuss.elastic.co/t/is-there-a-way-to-do-this-directly-in-kibana/189993/3 "2019-08-15T11:09:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
