# Picking up document which contains first recorded timestamp

**URL:** <https://discuss.elastic.co/t/picking-up-document-which-contains-first-recorded-timestamp/246518>\
**Category:** Kibana\
**Created:** [August 26, 2020, 10:10pm UTC](https://discuss.elastic.co/t/picking-up-document-which-contains-first-recorded-timestamp/246518 "2020-08-26T22:10:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [August 26, 2020, 10:10pm UTC](https://discuss.elastic.co/t/picking-up-document-which-contains-first-recorded-timestamp/246518/1 "2020-08-26T22:10:28Z")

</div>

Hi All,

We are pulling data from servicenow, where all the incident records are been pulled and there are duplicate incidents as well, and all the incidents are tagged with different different created time. We need to pull the first recorded time incident.

Is there a way to achieve or can we write any painless script to achieve this?

Please advice.

For your reference  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/b/5b52ee11fbb4f5e533986cf3bee99ebade2646f0.png)

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![Aaron\_Caldwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron_caldwell/32/45755_2.png) [@Aaron\_Caldwell](https://discuss.elastic.co/u/Aaron_Caldwell)\
**Post date:** [August 26, 2020, 10:51pm UTC](https://discuss.elastic.co/t/picking-up-document-which-contains-first-recorded-timestamp/246518/2 "2020-08-26T22:51:18Z")

</div>

Hello,

It sounds like you want a [top hits agg](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-top-hits-aggregation.html). If you set the quantity to one it will give you the most recent document by the timestamp you've specified.

Regards,  
Aaron

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [August 27, 2020, 8:56am UTC](https://discuss.elastic.co/t/picking-up-document-which-contains-first-recorded-timestamp/246518/3 "2020-08-27T08:56:45Z")

</div>

@Aaron_Caldwell My scenario is like i would need the first entered time stamp, not the recent one.  
Any advice on this please.

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2020, 8:56am UTC](https://discuss.elastic.co/t/picking-up-document-which-contains-first-recorded-timestamp/246518/4 "2020-09-24T08:56:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.