# Making filter for the last data set in Kibana discover **URL:** \ **Category:** Elasticsearch\ **Created:** [May 24, 2019, 4:36am UTC](https://discuss.elastic.co/t/making-filter-for-the-last-data-set-in-kibana-discover/182553 "2019-05-24T04:36:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![JIYOUNG](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@JIYOUNG](https://discuss.elastic.co/u/JIYOUNG)\ **Post date:** [May 24, 2019, 4:36am UTC](https://discuss.elastic.co/t/making-filter-for-the-last-data-set-in-kibana-discover/182553/1 "2019-05-24T04:36:47Z")
Hello. When using Kibana, I meet some problem. Kibana is tool using time-based. But I need to see the last data set. In Kibana Discover, I want to make Filter to see the last data. If using SQL, like the below: SELECT \* FROM TABLE\_NAME WHERE query\_time = (SELECT max(query\_time) FROM TABLE\_NAME) In the below script, I want to see data using the last time. "2019-05-24T04:16:47.782Z" --\> MAX(query\_time) query\_time is similar to @timestamp. ``` { "query": { "bool": { "must": { "match": { "query_time": "2019-05-24T04:16:47.782Z" } } } } } ``` Thanks. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 24, 2019, 7:25pm UTC](https://discuss.elastic.co/t/making-filter-for-the-last-data-set-in-kibana-discover/182553/2 "2019-05-24T19:25:19Z")
Use a top hits aggregation on the timestamp field and it should return what you want. ---
**Author:** ![JIYOUNG](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@JIYOUNG](https://discuss.elastic.co/u/JIYOUNG)\ **Post date:** [May 27, 2019, 1:25am UTC](https://discuss.elastic.co/t/making-filter-for-the-last-data-set-in-kibana-discover/182553/3 "2019-05-27T01:25:39Z")
Thanks for reply. I add filter like the below in "Discover - Filter". ``` { "aggs": { "the_latest": { "top_hits": { "sort": [ { "query_time": { "order": "desc" } } ], "_source": { "includes": [ "application_user_name", "duration" ] }, "size": 1 } } } } ``` But, There is internal error logs. I wonder this kind of the way is right or not. SearchError: Internal Server Error at [http://hostname:5601/bundles/commons.bundle.js:4:324908](http://hostname:5601/bundles/commons.bundle.js:4:324908) at processQueue ([http://hostname:5601/built\_assets/dlls/vendors.bundle.dll.js:427:199687](http://hostname:5601/built_assets/dlls/vendors.bundle.dll.js:427:199687)) at [http://hostname:5601/built\_assets/dlls/vendors.bundle.dll.js:427:200650](http://hostname:5601/built_assets/dlls/vendors.bundle.dll.js:427:200650) at Scope.$digest ([http://hostname:5601/built\_assets/dlls/vendors.bundle.dll.js:427:210412](http://hostname:5601/built_assets/dlls/vendors.bundle.dll.js:427:210412)) at Scope.$apply ([http://hostname:5601/built\_assets/dlls/vendors.bundle.dll.js:427:213219](http://hostname:5601/built_assets/dlls/vendors.bundle.dll.js:427:213219)) at done ([http://hostname:5601/built\_assets/dlls/vendors.bundle.dll.js:427:132717](http://hostname:5601/built_assets/dlls/vendors.bundle.dll.js:427:132717)) at completeRequest ([http://hostname:5601/built\_assets/dlls/vendors.bundle.dll.js:427:136329](http://hostname:5601/built_assets/dlls/vendors.bundle.dll.js:427:136329)) at XMLHttpRequest.requestLoaded ([http://hostname:5601/built\_assets/dlls/vendors.bundle.dll.js:427:135225](http://hostname:5601/built_assets/dlls/vendors.bundle.dll.js:427:135225)) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 27, 2019, 1:26am UTC](https://discuss.elastic.co/t/making-filter-for-the-last-data-set-in-kibana-discover/182553/4 "2019-05-27T01:26:33Z")
Why not just build a visualisation using it? ---
**Author:** ![JIYOUNG](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@JIYOUNG](https://discuss.elastic.co/u/JIYOUNG)\ **Post date:** [May 27, 2019, 1:29am UTC](https://discuss.elastic.co/t/making-filter-for-the-last-data-set-in-kibana-discover/182553/5 "2019-05-27T01:29:58Z")
My problem is that I want to see the last data set. But in visualization, I cannot find the way to see the data set like SQL query result. It is only possible to see the aggregated data in "Data table" type. ---
**Author:** ![JIYOUNG](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@JIYOUNG](https://discuss.elastic.co/u/JIYOUNG)\ **Post date:** [May 27, 2019, 2:42am UTC](https://discuss.elastic.co/t/making-filter-for-the-last-data-set-in-kibana-discover/182553/6 "2019-05-27T02:42:28Z")
What I want to see the data set is that the last query\_time(ex. May 24, 2019 @ 16:26:37.097) of whole data set. I want to see the information of user\_name and duration. In "Data Table" in visualization, only possible the SUM, AVERAGE data. For me, it is useless information. Time query\_time connection\_status connection\_id @timestamp application\_user\_name duration host.name system.cpu.user.pct May 24, 2019 @ 16:26:37.097 May 24, 2019 @ 16:26:37.097 RUNNING 234,277 May 24, 2019 @ 16:26:49.854 CHANGIL.LEE 1,480 - - May 24, 2019 @ 16:26:37.097 May 24, 2019 @ 16:26:37.097 RUNNING 236,296 May 24, 2019 @ 16:26:49.845 CHANGIL.LEE 165 - - May 24, 2019 @ 16:26:37.097 May 24, 2019 @ 16:26:37.097 RUNNING 235,950 May 24, 2019 @ 16:26:49.808 CHANGIL.LEE 822 - - May 24, 2019 @ 16:26:37.097 May 24, 2019 @ 16:26:37.097 RUNNING 234,156 May 24, 2019 @ 16:26:49.788 CHANGIL.LEE 694 - - May 24, 2019 @ 16:26:37.097 May 24, 2019 @ 16:26:37.097 RUNNING 234,156 May 24, 2019 @ 16:26:49.783 CHANGIL.LEE 694 - - May 24, 2019 @ 16:26:21.616 May 24, 2019 @ 16:26:21.616 RUNNING 236,095 May 24, 2019 @ 16:26:39.605 CHANGIL.LEE 309 - - ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 24, 2019, 2:42am UTC](https://discuss.elastic.co/t/making-filter-for-the-last-data-set-in-kibana-discover/182553/7 "2019-06-24T02:42:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.