Skip to content

[ESQL] LIMIT BY #112918

@nik9000

Description

@nik9000

Description

We'd like some ability to do a top-n, but per group key. This is similar to _search's collapse. Something like:

FROM foo
| SORT @timestamp DESC
| LIMIT 10 PER hostname

Would get you the 10 latest documents for each hostname.

Metadata

Metadata

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions