# Last value of each interface in the match phrase query

**URL:** <https://discuss.elastic.co/t/last-value-of-each-interface-in-the-match-phrase-query/287135>\
**Category:** Elasticsearch\
**Created:** [October 19, 2021, 9:41pm UTC](https://discuss.elastic.co/t/last-value-of-each-interface-in-the-match-phrase-query/287135 "2021-10-19T21:41:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [October 19, 2021, 9:41pm UTC](https://discuss.elastic.co/t/last-value-of-each-interface-in-the-match-phrase-query/287135/1 "2021-10-19T21:41:34Z")

</div>

Hi, How can I get the last value of each interface in the match phrase query? I have tried with max timestamp, but I get a time out error

```auto
GET /metrics-inf-*/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "bool": {
            "should": [
              {
                "exists": {
                  "field": "throughput_bps"
                }
              }
            ],
            "minimum_should_match": 1
          }
        },
        {
          "bool": {
            "should": [
              {
                "match_phrase": {
                  "q_interface_name": "Gi0/0/2 on (LM-A1K)"
                }
              },
              {
                "match_phrase": {
                  "q_interface_name": "Gi0/0/1 on (CH-A1K)"
                }
              },
              {
                "match_phrase": {
                  "q_interface_name": "Eth/61 on (LM-N9K)"
                }
              },
              {
                "match_phrase": {
                  "q_interface_name": "Eth/17 on (CH-N9K)"
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ]
    }
  },
  "_source": [
    "throughput_bps",
    "q_interface_name",
    "@timestamp"
  ]
}

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 19, 2021, 9:42pm UTC](https://discuss.elastic.co/t/last-value-of-each-interface-in-the-match-phrase-query/287135/2 "2021-10-19T21:42:29Z")

</div>

The last value being the one with the latest timestamp?

I'd try a top hits agg if that's the case.

---

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [October 20, 2021, 1:49am UTC](https://discuss.elastic.co/t/last-value-of-each-interface-in-the-match-phrase-query/287135/3 "2021-10-20T01:49:18Z")

</div>

Thanks @warkolm, I added this an it works

```auto
GET /metrics-inf*/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "bool": {
            "should": [
              {
                "exists": {
                  "field": "throughput_bps"
                }
              }
            ]
          }
        },
        {
          "bool": {
            "should": [
              {
                "match_phrase": {
                  "q_interface_name": "Gi0/0/2 on (LM-A1K)"
                }
              },
              {
                "match_phrase": {
                  "q_interface_name": "Gi0/0/1 on (CH-A1K)"
                }
              },
              {
                "match_phrase": {
                  "q_interface_name": "Ethernet1/61 on (LM-N9K)"
                }
              },
              {
                "match_phrase": {
                  "q_interface_name": "Ethernet1/17 on (CH-N9K)"
                }
              }
          ]
          }
        }
      ]
    }
  },
  "aggs": {
    "top_date": {
      "top_hits": {
        "sort": [
          {
            "@timestamp": {
              "order": "desc"
            }
          }
        ],
        "_source": {
          "includes": [
            "throughput_bps",
            "q_interface_name",
            "@timestamp"
          ]
        }
      }
    }
  }
}

```

but I only get 3 interfaces from the aggregation, checked the data in discover and all the interfaces exists and has value in throughput\_bps.

just checked the hits.hits payload and I get data with values from the missing interface.

Do you know why I only get 3 of the 4 interfaces? thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2021, 1:49am UTC](https://discuss.elastic.co/t/last-value-of-each-interface-in-the-match-phrase-query/287135/4 "2021-11-17T01:49:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.