elasticsearch – In Kibana Dashboard/Visualization – How do I count and visualize only latest doc based on certain field?

I’ve been stuck on some count metric on Kibana.

I have an index with docs representing items moving from station to station, each doc represents a station.

For example – an item moved between two station will have two docs (random id’s):

{
          "sn": "N00000000000",
          "process_id": "0001",
          "process_name": "distance",
          "station_name": "LAPTOP-999",
          "user": "doron",
          "logged": "2023-09-19T14:09:49.342013+03:00"
}
{
          "sn": "N00000000000",
          "process_id": "0002",
          "process_name": "flow",
          "station_name": "LAPTOP-999",
          "user": "doron",
          "logged": "2023-09-20T11:04:12.342013+03:00"
}

I am trying to do a simple metric box in the kibana dashboard to show how many items are in each station, but I want to exclude the ones that already moved to the next station.

That means I’m trying to use count for a sub data only contains the latest occurrence of each “sn”

In our example case, The count boxes will be:
Distance: 0
Flow: 1

I have been stuck on this for a while and really like to understand how to do such a thing generally

Thanks Alot!,
Doron

Read more here: Source link