# Show most recent documents by entity

**URL:** <https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929>\
**Category:** Kibana\
**Created:** [August 20, 2019, 12:36pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929 "2019-08-20T12:36:16Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![dominikw](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@dominikw](https://discuss.elastic.co/u/dominikw)\
**Post date:** [August 20, 2019, 12:36pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/1 "2019-08-20T12:36:17Z")

</div>

Hi,  
I'm trying to use one of the features introduced in Kibana 7.3 for Maps.  
I'm tracking vehicles, and because of that I have a lot of documents with Geo-points and indices of object.  
When I'm adding a new layer I want to show most recent documents by entity, which in my case is object Id. I would like to show the most recent position of a vehicle.

But when I select this option I get an error saying: 2 of 3 shards failed.

When I looked at elastic search log I can see error saying "No mapping for @timestamp to sort on".

Can you help me somehow?

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [August 20, 2019, 5:17pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/2 "2019-08-20T17:17:28Z")

</div>

Hey @dominikw, if you go to Management -\> Index Patterns and select the index pattern which contains your documents, do you see a label similar to the following at the top of the page?

 ![41%20AM](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7be6a634f0f0d6a53db2238d5838d9273a94cff5.png)

---

<div class="post-metadata">

**Author:** ![dominikw](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@dominikw](https://discuss.elastic.co/u/dominikw)\
**Post date:** [August 21, 2019, 7:50am UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/3 "2019-08-21T07:50:48Z")

</div>

Yes, this is exactly what I can see. That's why I'm totally confused by the log.

By the way, I tried to POST directly into elasticsearch service to obtain similar effect in response and it works.. I'm able to sort on the @timestamp there.

Is it possible that there is something wrong with Kibana?

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [August 21, 2019, 3:58pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/4 "2019-08-21T15:58:11Z")

</div>

@dominikw would you mind running the following queries in Dev Tools, replacing the `foo` index with the index you're pulling your documents from in the maps application and replying with the response?

```auto
GET /foo/_mapping
GET /foo/_field_caps

```

---

<div class="post-metadata">

**Author:** ![dominikw](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@dominikw](https://discuss.elastic.co/u/dominikw)\
**Post date:** [August 22, 2019, 9:54am UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/5 "2019-08-22T09:54:21Z")

</div>

Sure thing. Mappings first.

```
{
  "vehicle_plugin" : {
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "data" : {
          "type" : "nested",
          "properties" : {
            "location" : {
              "type" : "geo_point"
            },
            "speed" : {
              "type" : "float"
            }
          }
        },
        "groups" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "handlerId" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "mversion" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "oid" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "stage" : {
          "type" : "long"
        },
        "timestamp" : {
          "properties" : {
            "eventTime" : {
              "type" : "long"
            },
            "ingestTime" : {
              "type" : "long"
            },
            "lastProcessingTime" : {
              "type" : "long"
            }
          }
        },
        "type" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    }
  }
}

```

Field Caps causes error..

```
{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "specified fields can't be null or empty"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "specified fields can't be null or empty"
  },
  "status": 400
}
```

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [August 22, 2019, 2:47pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/6 "2019-08-22T14:47:01Z")

</div>

> I have a lot of documents with Geo-points and indices of object.

Do you have multiple Elasticsearch indices? Which Elasticsearch indices does your Kibana index pattern match? Does each Elsaticsearch index map `@timestamp` as `date`.

I have seen shard failures like this where a Kibana index pattern matches multiple Elastic search indices and the mapping type is not consistent between the Elasticsearch indices. This results in shard failures as one index can not successfully complete the query because the mappings are different and the difference causes an error

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [August 22, 2019, 3:03pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/7 "2019-08-22T15:03:29Z")

</div>

> Field Caps causes error

This is because the field capabilities request did not specify the required argument `fields`.

Try running  
`GET /foo/_field_caps?fields=@timestamp` or `GET /foo/_field_caps?fields=*`

---

<div class="post-metadata">

**Author:** ![dominikw](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@dominikw](https://discuss.elastic.co/u/dominikw)\
**Post date:** [August 22, 2019, 3:12pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/8 "2019-08-22T15:12:05Z")

</div>

Unfortunately no, I have only one index matching my Kibana index pattern.

---

<div class="post-metadata">

**Author:** ![dominikw](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@dominikw](https://discuss.elastic.co/u/dominikw)\
**Post date:** [August 22, 2019, 3:15pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/9 "2019-08-22T15:15:38Z")

</div>

Thanks for suggestion with field caps. Here is the output.

```
{
  "indices" : [
    "vehicle_plugin"
  ],
  "fields" : {
    "data" : {
      "nested" : {
        "type" : "nested",
        "searchable" : false,
        "aggregatable" : false
      }
    },
    "_index" : {
      "_index" : {
        "type" : "_index",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "_feature" : {
      "_feature" : {
        "type" : "_feature",
        "searchable" : true,
        "aggregatable" : false
      }
    },
    "timestamp.ingestTime" : {
      "long" : {
        "type" : "long",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "oid" : {
      "text" : {
        "type" : "text",
        "searchable" : true,
        "aggregatable" : false
      }
    },
    "type" : {
      "text" : {
        "type" : "text",
        "searchable" : true,
        "aggregatable" : false
      }
    },
    "timestamp.lastProcessingTime" : {
      "long" : {
        "type" : "long",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "timestamp.eventTime" : {
      "long" : {
        "type" : "long",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "_ignored" : {
      "_ignored" : {
        "type" : "_ignored",
        "searchable" : true,
        "aggregatable" : false
      }
    },
    "type.keyword" : {
      "keyword" : {
        "type" : "keyword",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "handlerId" : {
      "text" : {
        "type" : "text",
        "searchable" : true,
        "aggregatable" : false
      }
    },
    "@version" : {
      "text" : {
        "type" : "text",
        "searchable" : true,
        "aggregatable" : false
      }
    },
    "mversion.keyword" : {
      "keyword" : {
        "type" : "keyword",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "_version" : {
      "_version" : {
        "type" : "_version",
        "searchable" : false,
        "aggregatable" : false
      }
    },
    "mversion" : {
      "text" : {
        "type" : "text",
        "searchable" : true,
        "aggregatable" : false
      }
    },
    "timestamp" : {
      "object" : {
        "type" : "object",
        "searchable" : false,
        "aggregatable" : false
      }
    },
    "_routing" : {
      "_routing" : {
        "type" : "_routing",
        "searchable" : true,
        "aggregatable" : false
      }
    },
    "groups.keyword" : {
      "keyword" : {
        "type" : "keyword",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "_type" : {
      "_type" : {
        "type" : "_type",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "groups" : {
      "text" : {
        "type" : "text",
        "searchable" : true,
        "aggregatable" : false
      }
    },
    "data.speed" : {
      "float" : {
        "type" : "float",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "@version.keyword" : {
      "keyword" : {
        "type" : "keyword",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "oid.keyword" : {
      "keyword" : {
        "type" : "keyword",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "_seq_no" : {
      "_seq_no" : {
        "type" : "_seq_no",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "@timestamp" : {
      "date" : {
        "type" : "date",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "stage" : {
      "long" : {
        "type" : "long",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "_field_names" : {
      "_field_names" : {
        "type" : "_field_names",
        "searchable" : true,
        "aggregatable" : false
      }
    },
    "data.location" : {
      "geo_point" : {
        "type" : "geo_point",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "_source" : {
      "_source" : {
        "type" : "_source",
        "searchable" : false,
        "aggregatable" : false
      }
    },
    "_id" : {
      "_id" : {
        "type" : "_id",
        "searchable" : true,
        "aggregatable" : true
      }
    },
    "handlerId.keyword" : {
      "keyword" : {
        "type" : "keyword",
        "searchable" : true,
        "aggregatable" : true
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [August 22, 2019, 3:34pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/10 "2019-08-22T15:34:38Z")

</div>

Just noticed that `data` is nested and kibana [does not support nested types](https://www.elastic.co/guide/en/kibana/current/nested-objects.html). I wonder if this is causing some problems.

What does the Elasticsearch request/response look like when you enable most recent documents by entity? Follow the instructions [here](https://www.elastic.co/guide/en/kibana/current/maps-troubleshooting.html#_inspect_elasticsearch_requests) to view the request and response.

---

<div class="post-metadata">

**Author:** ![dominikw](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@dominikw](https://discuss.elastic.co/u/dominikw)\
**Post date:** [August 23, 2019, 3:17pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/11 "2019-08-23T15:17:11Z")

</div>

Oh, I was not aware about "Inspect" feature, nice to know this.

Seems like you were right at the beginning, Nathan. Even though Index Pattern Management was not showing more indices matching the pattern, I had some leftovers in elastic search which were satisfying the pattern. So the map viewer itself is using the regex pattern, not the actual index name for the requests.  
Thanks for help, everything seems fine now! I really appreciate your effort

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2019, 3:17pm UTC](https://discuss.elastic.co/t/show-most-recent-documents-by-entity/195929/12 "2019-09-20T15:17:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.