# Unable to visualize data correctly

**URL:** <https://discuss.elastic.co/t/unable-to-visualize-data-correctly/204601>\
**Category:** Kibana\
**Created:** [October 22, 2019, 8:04am UTC](https://discuss.elastic.co/t/unable-to-visualize-data-correctly/204601 "2019-10-22T08:04:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anne\_Kim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anne_kim/32/47196_2.png) [@Anne\_Kim](https://discuss.elastic.co/u/Anne_Kim)\
**Post date:** [October 22, 2019, 8:04am UTC](https://discuss.elastic.co/t/unable-to-visualize-data-correctly/204601/1 "2019-10-22T08:04:05Z")

</div>

Hi there,

I've an array, where elements look like this:

- 

```
 t _id htqe7m0BSOdvtuXlL_IK

```

- 

```
  t _index currency_data

```

- 

```
  # _score - 

```

- 

```
  t _type data

```

- 

```
  # player_id 457

```

- 

```
  # soft_currency_amount 95,792

```

- 

```
  soft_currency_last_update Oct 21, 2019 @ 16:57:01.000

```

This is information about a game player, his currency balance and the date when his balance was updated. There can be several recods for the same player.  
I need to visualize (firstly, as a Data Table) the balance of each player at the moment of the LAST update

```
{
  "aggs": {
    "4": {
      "terms": {
        "field": "player_id",
        "order": {
          "_key": "asc"
        },
        "size": 400
      },
      "aggs": {
        "2": {
          "terms": {
            "field": "soft_currency_amount",
            "order": {
              "2-orderAgg": "desc"
            },
            "size": 1
          },
          "aggs": {
            "3": {
              "terms": {
                "field": "soft_currency_last_update",
                "order": {
                  "1": "desc"
                },
                "size": 1
              },
              "aggs": {
                "1": {
                  "cardinality": {
                    "field": "player_id"
                  }
                }
              }
            },
            "2-orderAgg": {
              "max": {
                "field": "soft_currency_last_update"
              }
            }
          }
        }
      }
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "soft_currency_last_update",
      "format": "date_time"
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "soft_currency_last_update": {
              "format": "strict_date_optional_time",
              "gte": "2019-10-11T21:00:00.000Z",
              "lte": "2019-10-12T20:30:00.000Z"
            }
          }
        }
      ],
      "filter": [
        {
          "match_all": {}
        }
      ],
      "should": [],
      "must_not": []
    }
  }

```

As a result, I've a table with following columns: _player\_id_, _soft\_currency\_amount_, _soft\_currency\_last\_update_ and _Unique count of player\_id_. The last metric is used just for fit.  
All data are correct, **but** the "_soft\_currency\_last\_update_" column doesnt contain the _real_ last update. It shows the date when the appropriate balance amount appeared for the first time.  
For example, a player has 1000 coins on the 21 Oct at 2p.m., then his balance counted 1300 coins at 5p.m. The next (and the last) balance update was on the 22 Oct at 8a.m. when the balance remained the same (1300 coins).  
In this situation a table record will contain _soft\_currency\_amount_ - 1300, _soft\_currency\_last\_update_ - 21 Oct 5p.m (instead of 22 Oct at 8a.m.)  
What's wrong with it?

---

<div class="post-metadata">

**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\
**Post date:** [October 22, 2019, 2:13pm UTC](https://discuss.elastic.co/t/unable-to-visualize-data-correctly/204601/2 "2019-10-22T14:13:44Z")

</div>

You should be using the Top Hits aggregation, which can return a single record sorted by something like timestamp. This is possible using Visualize

---

<div class="post-metadata">

**Author:** ![Anne\_Kim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anne_kim/32/47196_2.png) [@Anne\_Kim](https://discuss.elastic.co/u/Anne_Kim)\
**Post date:** [October 23, 2019, 7:19am UTC](https://discuss.elastic.co/t/unable-to-visualize-data-correctly/204601/3 "2019-10-23T07:19:50Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2019, 7:19am UTC](https://discuss.elastic.co/t/unable-to-visualize-data-correctly/204601/4 "2019-11-20T07:19:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.