# \[Kibana 5.5.2\] condition in aggregated field with top\_hits

**URL:** <https://discuss.elastic.co/t/kibana-5-5-2-condition-in-aggregated-field-with-top-hits/114920>\
**Category:** Kibana\
**Created:** [January 10, 2018, 5:19pm UTC](https://discuss.elastic.co/t/kibana-5-5-2-condition-in-aggregated-field-with-top-hits/114920 "2018-01-10T17:19:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![salim\_ts86](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@salim\_ts86](https://discuss.elastic.co/u/salim_ts86)\
**Post date:** [January 10, 2018, 5:19pm UTC](https://discuss.elastic.co/t/kibana-5-5-2-condition-in-aggregated-field-with-top-hits/114920/1 "2018-01-10T17:19:20Z")

</div>

hello everyone,

I'm using a visualisation to contrôle the received documents in ES (with top\_hits on meta.localtime field).

the generated request:

```
{
  "query": {
"bool": {
  "must": [
    {
      "match_all": {}
    },
    {
      "range": {
        "ended": {
          "gte": 1507827469811,
          "lte": 1515603469811,
          "format": "epoch_millis"
        }
      }
    }
  ],
  "must_not": []
}
  },
  "size": 0,
  "_source": {
"excludes": []
  },
  "aggs": {
"2": {
  "terms": {
    "field": "meta.srcMaster",
    "size": 9999,
    "order": {
      "_term": "desc"
    }
  },
  "aggs": {
    "3": {
      "terms": {
        "field": "@policy",
        "size": 99999,
        "order": {
          "_term": "desc"
        }
      },
      "aggs": {
        "1": {
          "top_hits": {
            "docvalue_fields": [
              "meta.localtime"
            ],
            "_source": "meta.localtime",
            "size": 1,
            "sort": [
              {
                "meta.localtime": {
                  "order": "desc"
                }
              }
            ]
          }
        }
      }
    }
  }
}
  }
}

```

I want to filter results to get lines with the top\_hits aggregation "1" lower then "now-24h"  
I tried ti use "lt":"now-24h". But the top\_hits can't parse the query.

Thanx in advance for the help.

Regards

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [January 10, 2018, 6:46pm UTC](https://discuss.elastic.co/t/kibana-5-5-2-condition-in-aggregated-field-with-top-hits/114920/2 "2018-01-10T18:46:32Z")

</div>

Hello,

Would using a filter on meta.localtime \< now-24h get you your desired results? I don't really understand exactly what you are trying to do so I cannot reproduce the scenario locally in order to test this.

---

<div class="post-metadata">

**Author:** ![salim\_ts86](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@salim\_ts86](https://discuss.elastic.co/u/salim_ts86)\
**Post date:** [January 11, 2018, 10:26am UTC](https://discuss.elastic.co/t/kibana-5-5-2-condition-in-aggregated-field-with-top-hits/114920/3 "2018-01-11T10:26:24Z")

</div>

Hello Marius,

My visualisation contrôle the last received documents concerning my two fields SrcMaster and @policy. To do so i'm using the top\_hit aggregation in kibana

![image](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a245b4fc173f18965dbdcb30b9728a089a6b873e.png)

I'm trying to filter this visualisation and keep in the table only the couple (SrcMaster/Policy) with last received document lower then now-24h. Since i was not able to do it directly by filtering the aggregated field in kibana, i'm trying to get something using the Dev tools.

Hope it was clear.

Thank you for the help.  
salim

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2018, 10:26am UTC](https://discuss.elastic.co/t/kibana-5-5-2-condition-in-aggregated-field-with-top-hits/114920/4 "2018-02-08T10:26:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.