# Label data line as first or last

**URL:** <https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817>\
**Category:** Kibana\
**Created:** [September 21, 2022, 1:21am UTC](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817 "2022-09-21T01:21:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![razmizafiruddin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/razmizafiruddin/32/97628_2.png) [@razmizafiruddin](https://discuss.elastic.co/u/razmizafiruddin)\
**Post date:** [September 21, 2022, 1:21am UTC](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817/1 "2022-09-21T01:21:05Z")

</div>

Hi, i am new to kibana, i have some data loaded into index pattern as below. new data will be uploaded every 30 min. i am having problem to label/determine the first and last data for each serial number. i think it is achieveable using scripted field but i am unable to find the correct script for this situation.

this is sample of the data loaded. i want to add two column/label for each line whether it is "_is First_" or "_is Last_" test.  
 ![Kibana1](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6ba4678a2d554ccc53c49d8b9f4f486cc88500c9.png)

this is for when new data is loaded, the "_is Last_" label changed depends on the date.  
 ![Kibana2](https://us1.discourse-cdn.com/elastic/original/3X/5/7/5743023b7e6a374a4413b94adf82d22714926eaf.png)

Thank you 🙂

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 21, 2022, 1:24am UTC](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817/2 "2022-09-21T01:24:26Z")

</div>

Welcome to our community! 😃

So are the first and last states based only on the timings in the batch of data when it is loaded in? The batches are not related in anyway?

---

<div class="post-metadata">

**Author:** ![razmizafiruddin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/razmizafiruddin/32/97628_2.png) [@razmizafiruddin](https://discuss.elastic.co/u/razmizafiruddin)\
**Post date:** [September 21, 2022, 1:38am UTC](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817/3 "2022-09-21T01:38:33Z")

</div>

Hi warkolm, thank you for prompt respond. i am looking to based on those two parameter only. the **Serial** and the **LastTestDate** column. but if there is new data for that particular Serial, then the "is Last" data will change accordingly

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 21, 2022, 1:40am UTC](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817/4 "2022-09-21T01:40:28Z")

</div>

> [@razmizafiruddin](#):
>
> but if there is new data for that particular Serial, then the "is Last" data will change accordingly

That changes your approach a fair bit, as you need to read the data in Elasticsearch and then update it accordingly. You might want to look at using Logstash or an ingest pipeline to handle this.

---

<div class="post-metadata">

**Author:** ![razmizafiruddin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/razmizafiruddin/32/97628_2.png) [@razmizafiruddin](https://discuss.elastic.co/u/razmizafiruddin)\
**Post date:** [September 21, 2022, 2:12am UTC](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817/5 "2022-09-21T02:12:40Z")

</div>

meaning i cant use Scripted field for this issue?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 21, 2022, 2:26am UTC](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817/6 "2022-09-21T02:26:23Z")

</div>

I am not sure it could handle that level of complexity.

---

<div class="post-metadata">

**Author:** ![razmizafiruddin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/razmizafiruddin/32/97628_2.png) [@razmizafiruddin](https://discuss.elastic.co/u/razmizafiruddin)\
**Post date:** [September 21, 2022, 2:35am UTC](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817/7 "2022-09-21T02:35:36Z")

</div>

Thanks man. lets wait if got other opinion on this. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2022, 2:35am UTC](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817/8 "2022-10-19T02:35:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
