Can i apply a KQL query that works on all indices present?

Elastic Stack Kibana
1

Scenario:

  • I have a dashboard which displays info from two indices, a & b
  • both a& b have a field (which acts as a primary key would in sql) called id
  • i want to type into the search/query bar a filter that searches for documents in both indices that match to the desired id.

Would this be possible?

2

Yes, in general, this is possible. You would search for id:"alpha" and the dashboard would apply that filter to all elements (both indices).

Sometimes this doesn't work. This is usually due to mapping conflicts.

1 Like
3

yes, you can use any field in common between two or more indexes to filter the visualizations at a dashboard, and there is an additional option in the "Stack Management > Advanced Settings" that allows you to ignore the filter if the field used is not present in the index that creates the visualization. By default it is disabled.

Ignore filter(s)

This configuration enhances support for dashboards containing visualizations accessing dissimilar indexes. When disabled, all filters are applied to all visualizations. When enabled, filter(s) will be ignored for a visualization when the visualization's index does not contain the filtering field.

1 Like
4

Thank you for the replies. The problem was indeed a mapping conflict. The mapping for the field in both indices was different. They are now the same and it is working

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.