Advanced JSON input

I have a data table with data, Metrics, aggregation as count. ( as it shows all the log count)
see attached image(if avl)

i wish to get only the count of 5xx errors (500-599) in downstreamStatus data field using advanced json input field.
i have downstreamStatus as data field in filter field, but do not wish to apply that in "add filter" section.

is this achievable using advanced JSON input field ?

Hi @imsudo Welcome to the community!

What version of the Stack...

Lens you can put the KQL filter in the aggregation formulas.

In general if you are on a newer version you should start with Lens

Or using the legacy Table you can base the viz on a saved search

hi @stephenb
It's v 7.7.0

so how can i base the viz on saved search.. ?

Go to Discover
set the index pattern
Set the filters
Then use that saved search when creating the visualization.

BTW 7.7 is incredibly old and you should upgrade as soon as possible.

i did google version 7.7.0 is on 13th May 2020...

i tried but in Visualization - new Visualization - data table - choose source and .......... same place.. no option to use the saved one

Yes, that is nearly 3 Years old and over 15+ Significant Releases behind... just a suggestion.

Hmmm Right Here in the 7.7 Docs

The most frequently used visualizations allow you to plot aggregated data from a >>saved search<< or index pattern.

The most frequently used visualizations include:

  • Line, area, and bar charts
  • Pie chart
  • Data table
  • Metric, goal, and gauge
  • Tag cloud

So here is my 7.7 works fine


Data Table

Pick the Saved Search

Build Table off Saved Search

1 Like