# Show "latest" document, actually a composite of latest seen field values

**URL:** <https://discuss.elastic.co/t/show-latest-document-actually-a-composite-of-latest-seen-field-values/233932>\
**Category:** Elasticsearch\
**Created:** [May 22, 2020, 4:29pm UTC](https://discuss.elastic.co/t/show-latest-document-actually-a-composite-of-latest-seen-field-values/233932 "2020-05-22T16:29:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![J\_C](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/j_c/32/44738_2.png) [@J\_C](https://discuss.elastic.co/u/J_C)\
**Post date:** [May 22, 2020, 4:29pm UTC](https://discuss.elastic.co/t/show-latest-document-actually-a-composite-of-latest-seen-field-values/233932/1 "2020-05-22T16:29:24Z")

</div>

In an index I have a series of events, but they're usually incomplete. They will all have a "source" and a "timestamp" but different attributes will be present or not.  
Is there a way to visualize them in Kibana, for each "source" a complete composite documents - with the latest value of each attribute? Like if attribute A was set only last week A=4 and since then it never showed up in newer documents (attribute missing) I should see in my search result A=4? And this for many attributes of course, not only A.

---

<div class="post-metadata">

**Author:** ![J\_C](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/j_c/32/44738_2.png) [@J\_C](https://discuss.elastic.co/u/J_C)\
**Post date:** [May 23, 2020, 5:19pm UTC](https://discuss.elastic.co/t/show-latest-document-actually-a-composite-of-latest-seen-field-values/233932/2 "2020-05-23T17:19:31Z")

</div>

So it's not even possible? ☹

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 23, 2020, 8:43pm UTC](https://discuss.elastic.co/t/show-latest-document-actually-a-composite-of-latest-seen-field-values/233932/3 "2020-05-23T20:43:56Z")

</div>

It might be possible to use the [transform API](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-apis.html) to create a separate index where you have one document per source and update this based on the data written to the other index. You can then query this to get the latest state.

---

<div class="post-metadata">

**Author:** ![J\_C](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/j_c/32/44738_2.png) [@J\_C](https://discuss.elastic.co/u/J_C)\
**Post date:** [May 25, 2020, 8:08am UTC](https://discuss.elastic.co/t/show-latest-document-actually-a-composite-of-latest-seen-field-values/233932/4 "2020-05-25T08:08:08Z")

</div>

The transform API would help me to have the desired result always updated, nice point thank you.  
I'm still not sure how the query look should like - to have the desired result in the first place (instead of querying x times for getting latest each field).  
Could a set of sibling pipeline aggregations, one for each changeable field, construct the result?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2020, 8:08am UTC](https://discuss.elastic.co/t/show-latest-document-actually-a-composite-of-latest-seen-field-values/233932/5 "2020-06-22T08:08:21Z")

</div>

Closed on June 22, 2020, 8:08am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.