# Merge records into one table

**URL:** <https://discuss.elastic.co/t/merge-records-into-one-table/339067>\
**Category:** Kibana\
**Created:** [July 24, 2023, 9:59am UTC](https://discuss.elastic.co/t/merge-records-into-one-table/339067 "2023-07-24T09:59:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![akeelow](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@akeelow](https://discuss.elastic.co/u/akeelow)\
**Post date:** [July 24, 2023, 9:59am UTC](https://discuss.elastic.co/t/merge-records-into-one-table/339067/1 "2023-07-24T09:59:59Z")

</div>

Hello! cisco gateway sends 4 log entries for one voip call. All four records have a common id. Is it possible to create such a query in the Kibana interface to create a table where each row will contain the following fields: timestamp, cdn, cgn, duration?

This is what it looks like in Kibana:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fd83f217f0a22550a6d5d19fa8fe0a2b118b44f5.png)

---

<div class="post-metadata">

**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\
**Post date:** [July 25, 2023, 8:03am UTC](https://discuss.elastic.co/t/merge-records-into-one-table/339067/2 "2023-07-25T08:03:49Z")

</div>

Hi, I've tried locally, this could work, the fact is that you have to specify the total number of IDs you are looking to show. Then you can use the `Last Value` to get the values you are looking for on each record. This last value will filter your records where the field exists so it will take the last available in term of timestamp.

 ![Screenshot 2023-07-25 at 10.00.17](https://us1.discourse-cdn.com/elastic/original/3X/7/8/789dc9f0649e71f5e0e8a2b836ff781a3a1088de.png)

I also noticed that your example reports 2 different duration time, in this case you probably could take the Avergage duration instead of the last value.

---

<div class="post-metadata">

**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\
**Post date:** [July 25, 2023, 8:04am UTC](https://discuss.elastic.co/t/merge-records-into-one-table/339067/3 "2023-07-25T08:04:53Z")

</div>

Not shown in my example, but you can do the same for the timestamp as well, add the Last Value will work

---

<div class="post-metadata">

**Author:** ![akeelow](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@akeelow](https://discuss.elastic.co/u/akeelow)\
**Post date:** [July 25, 2023, 8:50am UTC](https://discuss.elastic.co/t/merge-records-into-one-table/339067/4 "2023-07-25T08:50:41Z")

</div>

Thank you! This works great for me!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2023, 8:50am UTC](https://discuss.elastic.co/t/merge-records-into-one-table/339067/5 "2023-08-22T08:50:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.