# Pick latest data

**URL:** <https://discuss.elastic.co/t/pick-latest-data/256361>\
**Category:** Kibana\
**Tags:** kql-kibana-query-language\
**Created:** [November 23, 2020, 1:37pm UTC](https://discuss.elastic.co/t/pick-latest-data/256361 "2020-11-23T13:37:30Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![vikram\_singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikram_singh/32/66490_2.png) [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\
**Post date:** [November 23, 2020, 1:37pm UTC](https://discuss.elastic.co/t/pick-latest-data/256361/1 "2020-11-23T13:37:30Z")

</div>

Hi,  
I am bulk inserting my data into an index multiple times in a day. I want to get all data with last timestamp(with last timestamp I inserted.).

---

<div class="post-metadata">

**Author:** ![afharo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/afharo/32/75202_2.png) [@afharo](https://discuss.elastic.co/u/afharo)\
**Post date:** [November 23, 2020, 4:25pm UTC](https://discuss.elastic.co/t/pick-latest-data/256361/2 "2020-11-23T16:25:22Z")

</div>

Hi @vikram_singh,

Since you tagged this in [`kibana-query-language`](https://discuss.elastic.co/tag/kibana-query-language), I'll assume you are referring to queries in the Kibana UI (either in Discover, Visualize, Dashboards, Maps, etc.).

In those apps, you can select the time frame to query via the Time Picker in the UI (mind the box with "Last 24 hours" on the right of the following screenshot):

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d88a0abde76b6fb67ef651db717a1c4747cc7ecb.png)

If you are referring to Elasticsearch queries, via the [Search API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html), you can use the `sort` property to request for your returned documents to be sorted. As an example:

```auto
GET kibana_sample_data_logs/_search
{
  "query": {
    "match_all": {}
  },
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![vikram\_singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikram_singh/32/66490_2.png) [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\
**Post date:** [November 30, 2020, 9:54am UTC](https://discuss.elastic.co/t/pick-latest-data/256361/3 "2020-11-30T09:54:02Z")

</div>

It will return all data in descending order by timestamp.  
But I am searching only all data with only latest time only.

---

<div class="post-metadata">

**Author:** ![afharo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/afharo/32/75202_2.png) [@afharo](https://discuss.elastic.co/u/afharo)\
**Post date:** [November 30, 2020, 4:01pm UTC](https://discuss.elastic.co/t/pick-latest-data/256361/4 "2020-11-30T16:01:28Z")

</div>

Do you mean from a given point in time?

If you know the latest timestamp you got data to act as a `from`, you can use the [Range queries](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html).

Or, if all the entries share the same timestamp, you can run a `term` query for that exact value.

---

<div class="post-metadata">

**Author:** ![vikram\_singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikram_singh/32/66490_2.png) [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\
**Post date:** [December 2, 2020, 4:34am UTC](https://discuss.elastic.co/t/pick-latest-data/256361/5 "2020-12-02T04:34:36Z")

</div>

Hi Afharo,  
Bulk data is inserting multiple times in a day in index, but not fixed time.  
Every time data insert is few thousand docs.  
For example data inserting 4 time at different random time point in a day( 1:00 AM, 9:00 AM, 4:00 PM, 8:00 PM).But I don't know which time data is insert.So my query is At 10:00 AM, I want to get only(it is few thousand docs) data inserted at 9:00 AM without knowing last inserted time. At 4:20 PM need to get all data inserted at 4:00 PM.  
Only last time inserted all data, without knowing that time point.

---

<div class="post-metadata">

**Author:** ![afharo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/afharo/32/75202_2.png) [@afharo](https://discuss.elastic.co/u/afharo)\
**Post date:** [December 2, 2020, 10:28am UTC](https://discuss.elastic.co/t/pick-latest-data/256361/6 "2020-12-02T10:28:33Z")

</div>

Hi @vikram_singh,

One last question, when you run your request at 4:20 PM, do you know your last query happened at 10:00 AM?

If so, you can use the [Range queries](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html) mentioned above. Something like:

```auto
GET my_index/_search
{
  "query": {
    "range": {
      "timestamp": {
        "gt": "2020-12-02T10:00:00.000Z",
        "lte": "2020-12-02T16:00:00.000Z"
      }
    }
  }
}

```

Do you think it might work for your use case?

---

<div class="post-metadata">

**Author:** ![vikram\_singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikram_singh/32/66490_2.png) [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\
**Post date:** [December 7, 2020, 6:04am UTC](https://discuss.elastic.co/t/pick-latest-data/256361/7 "2020-12-07T06:04:23Z")

</div>

Hi,  
I don't know last run query time and last data inserted time.  
You suggest range but range will not work in this case.  
You can understand top hits of last timestamp data.  
Requirement only last inserted bulk data. But query side I don;t know total inserted data at last time.And also don't know what is the last time of data insertion.  
The required result is showing in kibana list visualization with top hits on timestamp but by query, not able to get same result.

---

<div class="post-metadata">

**Author:** ![afharo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/afharo/32/75202_2.png) [@afharo](https://discuss.elastic.co/u/afharo)\
**Post date:** [December 9, 2020, 11:06am UTC](https://discuss.elastic.co/t/pick-latest-data/256361/8 "2020-12-09T11:06:09Z")

</div>

Hi @vikram_singh,

> [@vikram\_singh](#):
>
> The required result is showing in kibana list visualization with top hits on timestamp but by query, not able to get same result.

If you got a Kibana visualization working for you, then you can obtain the underlying ES query by using the "Inspect" button in the Visualization view. This feature shows you the underlying data, as well as the ES request and response.

I hope that helps 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 6, 2021, 11:06am UTC](https://discuss.elastic.co/t/pick-latest-data/256361/9 "2021-01-06T11:06:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
