Merge records into one table

[akeelow]

Hello! cisco gateway sends 4 log entries for one voip call. All four records have a common id. Is it possible to create such a query in the Kibana interface to create a table where each row will contain the following fields: timestamp, cdn, cgn, duration?

This is what it looks like in Kibana:

[markov00 (Marco Vettorello)]

Hi, I've tried locally, this could work, the fact is that you have to specify the total number of IDs you are looking to show. Then you can use the Last Value to get the values you are looking for on each record. This last value will filter your records where the field exists so it will take the last available in term of timestamp.

I also noticed that your example reports 2 different duration time, in this case you probably could take the Avergage duration instead of the last value.

[markov00 (Marco Vettorello)]

Not shown in my example, but you can do the same for the timestamp as well, add the Last Value will work

[akeelow]

Thank you! This works great for me!