Aggregate multiple records to single chart

Elastic Stack Kibana
21

Hi @LeeDr
Yes I'm trying to set my_index mapping docs after it indexed.
Regarding the deletion - if I remove this docs, how can I map data that is not exist?

There's no problem to delete it, I can restore it easliy

10x in advance

22

Hi @LeeDr
Any idea?
Tnx

23

Hi Avivc,

You still haven't posted example data such that I can understand your question, so I'm making some up. In the Dev Console I did this;

POST my_index/defect/
{
      "Project._refObjectName": "value1"
}

POST my_index/defect/
{
      "Project._refObjectName": "value2"
}

POST my_index/defect/
{
      "Project._refObjectName": "value3"
}

POST my_index/defect/
{
      "Project._refObjectName": "value4"
}

POST my_index/defect/
{
      "Project._refObjectName": "value5"
}

POST my_index/defect/
{
      "Project._refObjectName": "value1"
}

POST my_index/defect/
{
      "Project._refObjectName": "value2"
}

Then I made this scripted field named oneOrTwo;

if (doc['Project._refObjectName.keyword'].value == 'value1' || doc['Project._refObjectName.keyword'].value == 'value2') {
return "value1or2";
} else {
return doc['Project._refObjectName.keyword'].value
}

And then I made this visualization which shows a terms aggregation on that scripted field. Since there are 2 docs with value1 and 2 docs with value2 the chart shows a count of 4 docs with the value of value1or2;

image.png1642×1259 143 KB

I can also create the same chart without using the scripted field by using a Filter aggregation (the first filter is Project._refObjectName.keyword=value1 OR Project._refObjectName.keyword=value2

image.png1583×1302 164 KB

24

Hi @LeeDr

I've tried that before - it causing an error that related to unsupported files
But the 2nd option works great ! I think for now it's good enough for me.
I'll share some code and the error I'm getting for other developers too

Thank you very much :v::ok_hand:

BTW: using filtering in visualize exist from which version ?

25

I see the Filter aggregation being available as far back as 4.6.5 version of Kibana, probably earlier than that.