Map Visualization - Filter AFTER Top Hit Aggregation

Hey Everyone,

New user here, but I've been looking all over for this answer and haven't had any success. Essentially, I have a map with geopoints corresponding to a vehicle. A new document gets written for each vehicle every few minutes containing information about the vehicle including status. I'm attempting to create a map with a status layer based on the top hit of each vehicle sorted by the timestamp.

I'm able to get the latest and greatest version of the vehicle just fine, but things go sideways when I filter the status. For example, instead of filtering out vehicles that don't have a current active status, it gives me the document for that vehicle the last time it had that status even though there is a newer document for that vehicle without that status. I get why it's doing it, but I'm trying to figure out how to make it to do what I'm aiming for. Do I need to do cleanup on the underlying index to remove the previous version of the vehicle so nothing is returned on that layer? Been banging my head against the wall on this for awhile. Really appreciate your help.

Thanks

For your use case, would it make sense to use the global time filter to exclude values that are older then the last 4 minutes to avoid seeing older results?

There is an open issue for allowing layers to supply custom time ranges, https://github.com/elastic/kibana/issues/35658. Would having a feature like this help your use case?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.