# Return distinct values of a field in an alert

**URL:** <https://discuss.elastic.co/t/return-distinct-values-of-a-field-in-an-alert/368945>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [October 16, 2024, 8:18pm UTC](https://discuss.elastic.co/t/return-distinct-values-of-a-field-in-an-alert/368945 "2024-10-16T20:18:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Austin\_R](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@Austin\_R](https://discuss.elastic.co/u/Austin_R)\
**Post date:** [October 16, 2024, 8:18pm UTC](https://discuss.elastic.co/t/return-distinct-values-of-a-field-in-an-alert/368945/1 "2024-10-16T20:18:05Z")

</div>

I've created an alert that returns the results I'm looking for, but I want to return only one event per unique id field. I've tried a couple different things, but neither of them have worked for me so far.

Using Query DSL I've tried using 'collapse':

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/9/8964e258a292b559a745dec9c7b78a376fdee05c.png)

I've also tried using a 'top\_hits' aggregation:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f6561eedb6c58ac08475c3a75e73fd431e2f1c5f.png)

The results I'm getting are:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/7/777f7eccc9c10ad37e49c09009d8d30ec5609493.png)

But I'd like them to be:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/0/506b0bcd745af70bc4750e61fb317f39bb72fab2.png)

Am I doing something wrong or is this not possible using Query DSL in alerts?