it is possible to use Control visualization to filter on group of parameters?
Suppose that there are:
It is possible to have Control to choose Test or Prod and have all information about host.hostname: ServerTest* or host.hostname: ServerProd*?
Thank for your time
Yes, you can - you need a control viz with 2 separate option lists(one for Test/Prod and one for the servers). For the server control you configure the environment as parent:
This leads to the following result:
When you select an environment the hostname becomes active and provides you with a list of hosts to choose from.
for your quick response, I understand the idea and I think that It can works, but do you think that I have to create the
environment field using tags or fields.env from metricbeat.yml file configuration?
thanks so much
You need to use the fields.env option as tags cannot create keys with values as it is an array of keywords(see definition
here). It could be possible to use the tags (though I have not tried it myself) by specifying
tags as field name for the environment but if there are other tags added to the event those would show up as well(e.g. grok_parse_failure, ...).
I tried with tags and with fields.env I have correct data into discover ex:
but when I try to create the first option list I do not see env Field
thanks so much
Have you updated the kibana index pattern?
Yes I did but I think that the operation was slow now I have field
Thanks so much for your help
@Wolfram_Haussig sorry for the previous message. I have the field in to discovery as string but I continue to do not see field in visualization Field. It is strange
Can you please check what the index pattern page says about this field? I have just checked the documentation here:
Enhance dashboards | Kibana Guide [7.12] | Elastic
The dropdown menu is dynamically populated with the results of a terms aggregation
My guess is that the field is not marked as aggregatable in the index pattern. more than likely, the field was automatically mapped as text instead of keyword which does not support aggregation.
Thanks so much for your help,
I'll refresh the index I'm sure that your solution is perfect for my problem thanks so much @Wolfram_Haussig
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.