从 Elasticsearch 数据源获取 Grafana 中的最新元素

Question

In the Grafana Query editor, I'm trying to replicate the following elasticsearch DSL query:

{
  "query": {
    "match": {
        "hostname": "A"
    }
  },
    "sort": [
    { "utctimestamp": "desc" }
  ],
  "size": 1
}

It gives me most recent document in the index which has a field "hostname" with a value of "A".

I can get the value of the risk_num field from the most recent element of my elasticsearch index with the following query :

However, if i add a filter like hostname: "A" in the "Query" field, it will work if the most recent document in the index matches the 'A' hostname, but if the most recent document in the index has another hostname (let's say "B"), it will return the datetime of the document with the "B" hostname, and a risk_num value of null.

Example : I have the two following documents saved in my ES index :

{
    "_source": {
        "hostname": "B",
        "risk_num": 20,
        "utctimestamp": "2020-10-21T12:12:34.356Z"
    }
},
{
    "_source": {
        "hostname": "A",
        "risk_num": 10,
        "utctimestamp": "2020-10-21T12:11:03.489Z"
    }
}

The document with hostname B is more recent that the document with hostname A.

Request for hostname B is OK:

Request for hostname A returns null (expected: 10):

Any idea how I can get the last document of an index satisfying a certain condition in Grafana ?

Answer 1

I think I got it working correctly by setting the "Min Doc Count" option to 1: