Advanced JSON input

imsudo · January 3, 2023, 11:52am

I have a data table with data, Metrics, aggregation as count. ( as it shows all the log count)
see attached image(if avl)

i wish to get only the count of 5xx errors (500-599) in downstreamStatus data field using advanced json input field.
i have downstreamStatus as data field in filter field, but do not wish to apply that in "add filter" section.

is this achievable using advanced JSON input field ?

stephenb · January 3, 2023, 11:25pm

Hi @imsudo Welcome to the community!

What version of the Stack...

Lens you can put the KQL filter in the aggregation formulas.

In general if you are on a newer version you should start with Lens

Or using the legacy Table you can base the viz on a saved search

imsudo · January 11, 2023, 1:17pm

hi @stephenb
It's v 7.7.0

so how can i base the viz on saved search.. ?

stephenb · January 11, 2023, 2:42pm

Go to Discover
set the index pattern
Set the filters
Save
Then use that saved search when creating the visualization.

BTW 7.7 is incredibly old and you should upgrade as soon as possible.

imsudo · January 18, 2023, 7:26pm

i did google version 7.7.0 is on 13th May 2020...

i tried but in Visualization - new Visualization - data table - choose source and .......... same place.. no option to use the saved one

stephenb · January 19, 2023, 2:08am

Yes, that is nearly 3 Years old and over 15+ Significant Releases behind... just a suggestion.

Hmmm Right Here in the 7.7 Docs

The most frequently used visualizations allow you to plot aggregated data from a >>saved search<< or index pattern.

The most frequently used visualizations include:

Line, area, and bar charts

Pie chart

Data table

Metric, goal, and gauge

Tag cloud

So here is my 7.7 works fine

Discover