# Kibana Aggregation to get counts with Top Hit **URL:** \ **Category:** Kibana\ **Created:** [September 20, 2019, 9:43pm UTC](https://discuss.elastic.co/t/kibana-aggregation-to-get-counts-with-top-hit/200496 "2019-09-20T21:43:13Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![stephenchoy](https://avatars.discourse-cdn.com/v4/letter/s/35a633/32.png) [@stephenchoy](https://discuss.elastic.co/u/stephenchoy)\ **Post date:** [September 20, 2019, 9:43pm UTC](https://discuss.elastic.co/t/kibana-aggregation-to-get-counts-with-top-hit/200496/1 "2019-09-20T21:43:13Z")
I would like to create a metric that counts the number of hosts running different software versions. The tricky part is that each host regularly report its current versions to the ES. The version field changed as the software get upgraded and get reported. Here is the example of data. There are two hosts (host names are 414986NB001 and DESKTOP-2HF27UT) Both are running different released versions of software, and the first host reported two different versions because it got upgraded. ![39%20PM](https://us1.discourse-cdn.com/elastic/original/3X/7/8/785922259adeb6ee295e46a0a4050fc8c972350d.png) I would like to create a metrics of _count_ of hosts vs the _latest_ software versions they are running. i.e. we want to ignore the older history of records. In this example, 1.0.0.0 0 count 8000.0.415.0 1 count 1.2.28.0 1 count I tried different approaches from Visual but it didn't come up what I wanted. Please advise any approaches. (I feel like I should start with querying the documents with filtering out all old records for each host first and then do the aggregations. However, I don't know how to do that from Discover either.) Thanks. ---
**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Post date:** [September 20, 2019, 11:51pm UTC](https://discuss.elastic.co/t/kibana-aggregation-to-get-counts-with-top-hit/200496/2 "2019-09-20T23:51:50Z")
Hello. Literally reading your sentences, > In this example, > 1.0.0.0 0 count > 8000.0.415.0 1 count > 1.2.28.0 1 count This sounds like standard _terms aggregation_ on your _version field_. For filtering out versions, if your versions field are _keyword field_ then you have to specify the actual version in _discover_ search bar . e.g version: 1.0.0.0 However, this is not good if you have multiple versions to filter. So, you want to use _numeric data type_ for version field. Since you want to use it in combination with above _terms agg_ , one approach is you could try [multi field](https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html). Your mapping might be something like, ```auto { "mappings": { "properties": { "vers": { "type": "keyword", "fields": { "major": {"type": "integer"}, "minor": {"type": "integer"}, "patch": {"type": "integer"} } } } } } ``` Then in your _discover_ or _filter context_ in vis , you could do something like, e.g `vers.major: [8000 TO *] AND vers.minor: [1 TO *]` Of course you could create as separate field in same document to. Don't forget to parse to corresponding fields in your _pipeline program before indexing_ or _ingest pipeline in elasticsearch_ ---
**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\ **Post date:** [September 21, 2019, 12:27am UTC](https://discuss.elastic.co/t/kibana-aggregation-to-get-counts-with-top-hit/200496/3 "2019-09-21T00:27:42Z")
The latest software version a host is running would come from the latest timestamp for that host, right? If they downgrade a host to an earlier version and the earlier version would be the "latest"? As far as I can tell, there is no way to do this in TSVB or Data tables. I think it requires an advanced pipeline aggregation. Perhaps this is possible with Vega, but that could get difficult. ---
**Author:** ![stephenchoy](https://avatars.discourse-cdn.com/v4/letter/s/35a633/32.png) [@stephenchoy](https://discuss.elastic.co/u/stephenchoy)\ **Post date:** [September 21, 2019, 12:44am UTC](https://discuss.elastic.co/t/kibana-aggregation-to-get-counts-with-top-hit/200496/4 "2019-09-21T00:44:35Z")
Thanks for your reply and comments. In your example, if some host downgraded the software version, the software would send another log to ES for the latest version (regardless it is downgrade/upgrade). That is why there are several entries of documents from the same host for reporting the software version. Just thinking out loud, if I can somehow SEARCH for the latest version data entry log for each host, and somehow the set of filtered data is being used for aggregation, that the whole day become easy. sample entry (3 parsed fields) time stamp hostname version (in string) Mon 1:00am host1 1.2 \<--- same data entries older than this time filtered out from this hosts. Fri 1:00pm host2 3.0. \<--- older data entries from this host filtered. ---
**Author:** ![stephenchoy](https://avatars.discourse-cdn.com/v4/letter/s/35a633/32.png) [@stephenchoy](https://discuss.elastic.co/u/stephenchoy)\ **Post date:** [September 21, 2019, 12:46am UTC](https://discuss.elastic.co/t/kibana-aggregation-to-get-counts-with-top-hit/200496/5 "2019-09-21T00:46:47Z")
Thanks for your reply. Actually, the concern is not about the nature of the version value. it is just a plain string. Please see my other reply. Thanks again. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 7:26am UTC](https://discuss.elastic.co/t/kibana-aggregation-to-get-counts-with-top-hit/200496/6 "2022-11-04T07:26:22Z")