Feature request: Ability to specify collapse search field in Document Table

[koubessus]

Hi @fbaligand ,

would it be possible to add "Collapse field" to document table? The idea is to be able to use collapsed search, i.e. to pick up a field to be used in search request:

{
  "query": {},
  "collapse": 
    {
      "field": "host.hostname"
    },
    "sort": {}
}

The most basic use case is also the most useful - when reporting state on a regular basis we want to show only the latest one (when sorted by timestamp).

Thanks.

[fbaligand]

Hi @koubessus,

This could be an enhancement. That said, today, to answer your precise need, you can use "Enhanced Table", with:

• a "Split Rows" bucket using a "Terms" aggregation based on "host.hostname"
• For each column you wan to see, a "Top Hit" metric with sort based on "timestamp" field