# Rollup Job when one of the Terms field is array of objects

**URL:** https://discuss.elastic.co/t/rollup-job-when-one-of-the-terms-field-is-array-of-objects/328451
**Category:** Kibana
**Tags:** rollups
**Created:** [March 24, 2023, 11:28am UTC](https://discuss.elastic.co/t/rollup-job-when-one-of-the-terms-field-is-array-of-objects/328451 "2023-03-24T11:28:03Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![jiri\_whale](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@jiri\_whale](https://discuss.elastic.co/u/jiri_whale)
#### Post date: [March 24, 2023, 11:28am UTC](https://discuss.elastic.co/t/rollup-job-when-one-of-the-terms-field-is-array-of-objects/328451/1 "2023-03-24T11:28:03Z")

</div>

I am trying to create a RollUp job from Kibana. In the Terms field where I have given multiple fields, in which one of the fields is of an array type (actually array of objects). How can I define which item/object of the array should be part of the RollUp job?  
In the example below, e.g. details.time.observation - can I address somehow either first or last object in the array or the latest one (i.e. max value of a object's time.observation field in the array)?

```auto
{
  "_index": "...",
  ...
  "_source": {
    "method": "GET",
    "logged": "2023-03-24T08:34:02+0000",
    "@timestamp": "2023-03-24T08:34:02.000Z",
    "client": "ABC",
    "request": {
      "name": "get_data",
      "ip": "10.10.10.10"
    },
    "details": [
      {
        "source": {
          "name": "get_data"
        },
        "time": {
          "observation": "2021-12-13T14:57:49+0000"
        },
        "seen": {
          "first": "2021-12-14T01:31:59+0000",
          "last": "2023-03-23T10:36:37+0000"
        },
        "status": {
          "code": "200"
        }
      },
      {
        "source": {
          "name": "get_data"
        },
        "time": {
          "observation": "2021-15-12T14:25:29+0000"
        },
        "seen": {
          "first": "2021-13-18T01:31:59+0000",
          "last": "2023-03-23T10:36:37+0000"
        },
        "status": {
          "code": "404"
        }
      }
    ],
    "log": {
      "file": {}
    },
    "client_ip": "192.168.0.37"
  }
}

```

Group by on: client, request.name, details.time.observation [either first/last in the array or one with a max value]

---

<div class="post-metadata">

### Author: ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)
#### Post date: [March 24, 2023, 8:30pm UTC](https://discuss.elastic.co/t/rollup-job-when-one-of-the-terms-field-is-array-of-objects/328451/2 "2023-03-24T20:30:56Z")

</div>

@alisongoryachev can we please get some help?

Thanks,  
Bhavya

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 21, 2023, 8:31pm UTC](https://discuss.elastic.co/t/rollup-job-when-one-of-the-terms-field-is-array-of-objects/328451/3 "2023-04-21T20:31:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.