Add columns to aggregated Table visualization

Need a little help with Table visualization.

Basically, I have web log with GeoIP column.

I want to show 10 most frequent IPs for a time period (which is super easy with Table visualization).

I want to add few GeoIP columns for these IP, namely [city, county and continent].

The only way I found is to do sub aggregations for the new columns...

Is there way to do join and show it Table visualization? :blush:


Unfortunately doing a join is not possible on table viz. Sub-aggregations is the way to go.

You can check out canvas where you can use elasticsearch-SQL plugin and you might close to what you need.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.