I want to order documents in Discover by a date field using KQL or Lucene.
Can you guide me please?
KQL and Lucene have a limitied scope - they are only defining the filter (like the "WHERE" part of a SQL query), not the order. However in Discover you can click the column header in the document table and it will get sorted by this field.
Thanks Joe,
Yes, I did sort using column header but when I create visualizations from the saved search it won't show up as sorted.
Simply I want create a Pie chart to show ticket details (Agg: unique count with ticket Id, buckets: Terms with ticket status) My index has multiple documents for a ticket with their status and need to show latest status in the Pie chart.
The visualization you want to create (only considering the "latest" document per ticket id) is not possible to achieve purely using the visualizations in Kibana. You have to make sure there is an index only containing documents for the current status per ticket.
I created an index to store ticket details and set ticket id as doc id to maintain a single document for a ticket. But since we create daily indices, if a ticket get closed in next day , then the same ticket get stored in 2 different indices. And ended up with same issue. 
Ticked id as document id sounds like a good approach.
But since we create daily indices
What's your data volume? Daily indices are pretty fine grained which makes sense for high volume log data but might not be the right choice for a "state index" like your ticket details. Consider just keeping a single index with all of your tickets if it's not an issue to store them indefinitely.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.