Kibana data table with TopHit aggregation

Hi,

In my ELK setup I have documents like this,
{
"message_id" : "1",
"name" : "customer1",
"login_status": "loggedIn",
"company": "Abc"
},
{
"message_id" : "2",
"name" : "customer1",
"login_status": "loggedOut",
"company": "Abc"
},
{
"message_id" : "3",
"name" : "customer2",
"login_status": "logged_in",
"company": "Abc"
},
{
"message_id" : "4",
"name" : "customer3",
"login_status": "loggin_failed",
"company": "XYZ"
}

I want to visualize these information in a data table to show the current logged in status of each user. I have tried to do this using TopHit (top hit based on the message_id filed - descending order) and I was able to visualize this as required. However, I want to put a input control to filter out based on the logging status. When I select the logged_in status from the filter I'm getting the customer1 as a result due to the first record. I understand technically this is correct since as per my filtering criteria, first message is the latest record.
However, I want to do the filtering only from the latest records for each customer. So when I filter for the logged_in users, customer1 should be visible in the table.

Any idea on how to visualize this type of behavior? I have the feasibility to modify the json document structure if required. Really appreciate any help on this.

Thanks in advance.

Manjula

i would suggest using Canvas and the ESSQL commands to try this, but I'll warn you that Elasticsearch isn't really for this, it's more for looking at historic data and trends.

Hi Marius,

Thank you for your reply, I’ll try with Canvas and yes, I understand your point about Elasticsearch. I’m using it for historical data and trends of course,but unfortunately I have this odd use case as well :frowning:
Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.