# Outputting new values in the last X months compared to entire timeline

**URL:** https://discuss.elastic.co/t/outputting-new-values-in-the-last-x-months-compared-to-entire-timeline/192244
**Category:** Elasticsearch
**Created:** [July 25, 2019, 12:33pm UTC](https://discuss.elastic.co/t/outputting-new-values-in-the-last-x-months-compared-to-entire-timeline/192244 "2019-07-25T12:33:52Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![yananas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yananas/32/50921_2.png) [@yananas](https://discuss.elastic.co/u/yananas)
#### Post date: [July 25, 2019, 12:33pm UTC](https://discuss.elastic.co/t/outputting-new-values-in-the-last-x-months-compared-to-entire-timeline/192244/1 "2019-07-25T12:33:52Z")

</div>

Greetings,

Using Elasticsearch 2.4, directly by DSL query.

I am looking for a way to output values that only appeared in the last X months compared to the entire timeline.

Example: given a dataset with these data

| NAME | DATE |
| A | 01-01-2017 |
| A | 01-01-2018 |
| A | 01-01-2019 |
| B | 01-01-2018 |
| B | 01-01-2019 |
| C | 01-01-2019 |

I would like to retrieve the data that appeared in the last 12 months but never appeared before 12 months ago. In other words, the data that appeared for the first time ever in the last 12 months.

Expected result would be:

| NAME | DATE |
| C | 01-01-2019 |

I'm not sure how to approach this with an ES query, does anyone have an idea?

Thanks in advance

---

<div class="post-metadata">

### Author: ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)
#### Post date: [July 26, 2019, 9:24am UTC](https://discuss.elastic.co/t/outputting-new-values-in-the-last-x-months-compared-to-entire-timeline/192244/2 "2019-07-26T09:24:02Z")

</div>

The `significant_terms` aggregation should be able to help with that.  
Just do a range query for the last 12 months and use the significant\_terms aggregation on the `name` field.  
Note this sort of "what's new?" analysis won't typically work if you are using time based indices (e.g. one new index per month/year). It's very hard to do any kind of extensive "diff" when the content being compared is on different machines.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 23, 2019, 9:24am UTC](https://discuss.elastic.co/t/outputting-new-values-in-the-last-x-months-compared-to-entire-timeline/192244/3 "2019-08-23T09:24:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.