Canvas filters - is it possible to filter a visualization

Elastic Stack Kibana
1

Hi there,

I'm playing with Canvas and I have particular use case where I need to place a filter on a kibana object to filter the data out by a range from 3 thru 5 (event severity), I don't want to modify the visualization or create a new visualization just for this specific use case. I'm familiar with how to use "dropdown select" filters, but that doesn't help me with this use case since the dropdown select only allows to filter by a single value. Can someone please point me at how to filter by either range or multiple values?

TIA!

Azulgrana

3

Hello @azulgrana,

You can use the expression syntax, and then add a filter to retrieve data given an Elasticsearch SQL query.

If I understand correctly it will be something like this:

kibana
| selectFilter
| essql query="SELECT * FROM your_index WHERE severity_field >= 3 AND severity_field <= 5"
| table
| render

Hope this helps!

5

Thanks Priscilla for your response. Unfortunately that doesn't help. To clarify my use case, I have a Kibana pie chart that shows all the events by severity (1 thru 5). On my Canvas workpad I want to re-use the same Kibana visualization but I also want to limit the scope to events with severity 3 thru 5. I know I can probably create a new Kibana pie chart with the 3-5 scope and add it to my Canvas or use a custom Canvas Pie chart with ESQL as you mentioned on your response, though I'm trying to avoid these last two options as my goal is to simply my Canvas workpad approach/maintenance.

Is this I'm asking doable within Canvas?

Thanks!

Azulgrana

6

Hello @azulgrana,

Thanks for the additional context.

I was thinking about using a scripted field and then selecting it in the 'dropdown select' filter, but unfortunately, Canvas doesn't support scripted fields at the moment, so that's not an option.

I know you don't want to edit this visualization, but what if we simply add a Kibana KQL filter to it? Do you think that could be useful?

Edit the visualization:

IMG_1464
IMG_1464812×524 94.7 KB

And then add a filter severity_field >= 3 AND severity_field <= 5 to the Kibana KQL query bar of this visualization and save it Save and return.

IMG_1466
IMG_14661170×995 70.1 KB

Hope it helps, pls let me know!

7

Unfortunately that would not work. Here's the thing, I have the same visualization on one of my main dashboards and on that one I want it to display all events (severity 1-5) now, on the Canvas I want to take a more executive approach and only show the stuff that needs immediate action (severity 3-5). That's why I was hoping to find a way to use the same visualization on both places with the difference of way/option to filter the visualization in Kibana to only display the high severity events. Sounds like maybe what I'm asking is not that doable.

Thanks for your help though,

Azulgrana

8

You're welcome!

In this case, considering that you want to avoid:

  • Using Canvas expression syntax (elements in Canvas are all created using an expression language).
  • Adding a filter to this visualization and then "save and return" to Canvas.
  • Creating another pie visualization with a new filter and saving it to the library to then add it to your Canvas.

I can't think of another option.

When you add a Saved Visualization to Canvas, you are adding an embeddable, and therefore, you need to inspect it to edit the visualization itself. This is different from the case of being a Pie Chart Canvas Element.

If your goal is to have the data on two different pages but use the same visualization without adding a specific filter to it, my suggestion would be for you to consider having two dashboards with this visualization, using different filters in each dashboard, and saving the dashboards with the filters.

Hope it helps!