Can I apply filtering in specific buckets and not in the whole visualization in Kibana?

Elastic Stack Kibana
1

I have some documents with the fields client.ip and http.response.status.code among other fields. I have also some documents with the fields client.ip and company.name.

What I want to is to create a visualization with all the client.ip which http.response.status.code is 503 and then associate them with the company.name field. I have tried to achieve this using filters but filters apply to all buckets in kibana visualization so that doesn't work. Is there any other way to do this ?

2

Would a data table with top x hits of client.ip, split by company.name and with a filter for
503" on a scripted field that says:
if (!doc.containsKey(' `http.response.status.code`') || doc[' `http.response.status.code`'].empty) { return "unavailable" } else { return doc[' `http.response.status.code`'].value }"

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.