Kibana aggregations help

Elastic Stack Kibana
1

Hi all,

I am trying to get the latest document based on a field

example
'''
container_id state time
1 A 2pm
1 B 1pm
1 C 6pm
2 A 3pm
2 B 6pm
2 C 2pm

solution I want to display in Kibana is

state count
A 0
B 1 (current container state for container id 2)
C 1 (current container state for container id 2)
'''
How do I do this in Kibana?

2

You can get the latest document by using "top hits" metric. In the example below I am using a top hits metric aggregation to show the timestamp field for the last document sorted on the timestamp field.

Screen Shot 2020-11-06 at 4.01.06 PM
Screen Shot 2020-11-06 at 4.01.06 PM4090×2048 397 KB

3

Hi Nathan ,

thank you. there needs to be another level of aggregation which is container_id in my example above and show the count of each state.

Screen Shot 2020-11-06 at 4.40.30 PM
Screen Shot 2020-11-06 at 4.40.30 PM2067×1012 121 KB

What I actually need is

Staged 10
Stacked 4
Loaded 8

where 10 containers have a current state (based on latest timestamp) of Staged
4 have Stacked
8 have Loaded

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.