How to display unique count with latest value from Elasticsearch in Kibana - elasticsearch

Question

I'm New in ELK. I have created index with name "ordersatus" which store the status published by logistic partner.
whenever logistic partner update the order status then new status is pushed into elasticseach.
Now every order is having multiple enteries with order status like "ORDER CONFIRM" , "APPOINTMENT SCHEDULED" , "OUT FOR DELIVERY" etc..
Problem arise when i need to see how many order are in which status.
Total Order Count is 2, but in order status i get total count 4. because it count older values too. as you can see in attached screenshot.
I Want to Display all unique order status along with the order count having that status.
i.e
ORDER STATUS | TOTAL COUNT
APPOINTMENT_CONFIRMED | 1
ASSIGN_FOR_DELIVERY | 1
as of now its Displaying order status "CONFIRMED" with count 2. which is older value of these 2 orders.
Screenshot1
Screenshot2

Answer 1

You want the distinct statuses and their count in the table of the second screenshot? You have two selections in the buckets — timestamp and status: Remove the timestamp, since this will split into every unique timestamp. What you want is only the status.
This is a different dataset, but you get the idea:

Answer 2

As a workaround, you can add the below to the logstash config for adding weights for each status. When the status transforming from the previous status, add -1 to the previous status weight and add 1 to the new status weight.
if [status] == "ORDER CONFIRM" {
mutate { "add_field" => { "order_confirm_weight" => "1" } }
mutate { convert => { "order_confirm_weight" => "integer" }}
} else if [status] == "APPOINTMENT SCHEDULED" {
mutate { "add_field" => { "order_confirm_weight" => "-1" } }
mutate { convert => { "order_confirm_weight" => "integer" }}
mutate { "add_field" => { "appointment_scheduled_weight" => "1" } }
mutate { convert => { "appointment_scheduled_weight" => "integer" }}
} else if [status] == "OUT FOR DELIVERY" {
mutate { "add_field" => { "appointment_scheduled_weight" => "-1" } }
mutate { convert => { "appointment_scheduled_weight" => "integer" }}
mutate { "add_field" => { "out_for_delivery_weight" => "1" } }
mutate { convert => { "out_for_delivery_weight" => "integer" }}
}
Once the configuration is added to the logstash, you can get the count of each status in kibana visualization using the below aggregating functions.
ORDER CONFIRM Count = Sum (order_confirm_weight)
APPOINTMENT SCHEDULED Count = Sum (appointment_scheduled_weight)
OUT FOR DELIVERY Count = Sum (out_for_delivery_weight)