Best approach for adding columns to a simple Data Table visualization

I'm trying to create some simple Data Table visualizations in Kibana 7.4.2, essentially mimicking the results of a Saved Search in Discover, with of course the added ability to download a CSV export.

Assume my index is a collection of documents describing Books.

After Splitting Rows with a Terms Aggregation on the "bookId" field, I want to add the "title" as a column.
Is it better to do this as a sub-bucket, further splitting rows with a Term Aggregation on the "title" field (as described here -, or as a Metric, with a Top Hit Aggregation on the "title" field (as described here - Adding Columns in Data Table)?
Are there any advantages - performance or otherwise - to one approach over the other?

What if my index potentially has duplicate documents for each book (due to denormalization), but I'm still certain that each copy has the same "title"?


I don't think there are relevant performance differences between these approaches, both should be fine in practice.

If you are running the default distribution, there is also a CSV export available in Discover:

I also noticed that doing a sub-bucket removes any entries that don't have a value for the given field, so for my needs, that means I'll be going with the metric approach.
And my installation doesn't have the CSV option under Share, perhaps because I'm running an AWS installation. In any case, the 500-result limit is another reason for me to use Visualizations instead of Discover.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.