Canvas Dropdowncontrol filter limit

[prasadasokan]

When trying to use Canvas Drop down control filter, we see that it is able to fetch only 100 records. We are able to use order by to sort these 100. But is there a way for us to apply time filter first, and then get this drop down control filter show up values in that time range?

Or a text field with auto complete can be of help too. Please advice.

[Joe_Fleming]

tl;dr - What you need isn't currently possible, but it is planned functionality, and you can kind of work around it for now.

I'll speak a little abstractly here, but hopefully it's helpful. The dropdown filter, like every other element in Canvas, is powered by its own expression. That expression provides the values that show up, and then applies a filter when you pick something using it.

So with that in mind, the dropdown filter can itself use filters. Simply starting the expression with filters is all it takes. The problem, however, is that filters are an "all or nothing" concept right now. That is, if you opt in to using filters in the expression (via that function), you are opting in to all of the filters in the workpad. What you need is a feature we've got planned but haven't yet built; the ability to selectively choose which filter(s) you want, and ignore the rest. In your case, you want to opt in to the time filter for the dropdown, but not the dropdown's filter.

This is the issue to track that feature, should you care to follow it: https://github.com/elastic/kibana/issues/23117

Right now the best you can do is opt into all of the filters on the dropdown, which would filter the list by the selected time range, but would also filter the list by the filter value, meaning that once you pick a value from the dropdown, it will be the only value you see in the list.

You can get around this by not using filters in the dropdown, but it would mean that the list would not react to the time range anymore. It almost certainly makes that dropdown less value, since the options in it won't change, but at least it would work, and the worst-case situation is you pick a value that matches no documents in the selected time range and you get no results for the other elements. The gist of it is that you remove filters from the dropdown's expression and instead just query everything (most likely using essql) and apply whatever filters you'd like in the query. The list of items won't change, but again, they also won't be limited by the time filter, but they can be limited by the query (meaning the range would be fixed, unless you change the query). Here's an example:

I'm guessing you have something like this, almost certainly more complex, and this is kind of a pseudo query, but I'm just trying to explain the relevant parts of the expression.

filters | esquery query="...query selecting uniq list of values from some field..." | sort | dropdownControl

As I mentioned, this would apply all filters, including both the time filter and the filter value of the dropdown itself. Instead, you'd drop filters and tweak the query:

esquery query="...query selecting uniq list of values from some field, and also limiting by some time range..." | sort | dropdownControl

You don't strictly need the time range in the query, you can query and group and filter however you need. Now the values never change, but at least you have access to any of the ones you need. It's not ideal, but it's functional and is closer to what you want.

If you can share the expression you're using for the dropdown, I can try to provide specific help if you need it.

And as for the 100 record limit, I'm not sure why you're getting that. The default limit for both esdocs and essql is 1000, and you can customize that. There's nothing in the dropdown code that limits the list to 100 things, at least as far as I know or can see in the code.