How do I count and visualize only latest doc based on certain field?

Doron_Abramovich
Wed, 20 Sep 2023 12:24:35 +0000
Kibana

Hi everyone
First post here after working for over year with elastic.

I have an index with docs representing items moving from station to station, each doc represents a station.

For example - an item moved between two station will have two docs (random id's):

{
          "sn": "N00000000000",
          "process_id": "0001",
          "process_name": "distance",
          "station_name": "LAPTOP-999",
          "user": "doron",
          "logged": "2023-09-19T14:09:49.342013+03:00"
}
{
          "sn": "N00000000000",
          "process_id": "0002",
          "process_name": "flow",
          "station_name": "LAPTOP-999",
          "user": "doron",
          "logged": "2023-09-20T11:04:12.342013+03:00"
}

I am trying to do a simple metric box in the kibana dashboard to show how many items are in each station, but I want to exclude the ones that already moved to the next station.

That means I'm trying to use count for a sub data only contains the latest occurrence of each "sn"

In our example case, The count boxes will be:
Distance: 0
Flow: 1

Please let me know if you further questions!
I have been stuck on this for a while and really like to understand how to do such a thing generally

Thanks alot!,
Doron

4 posts - 3 participants