The question is if there is any way to create a Pie Chart in Kibana which can show me these messages (which have two suffix) in one colour and rest of log messages in different colour like following picture:
Maybe you have also erased the rendering option for the pie.
To start easily try first to get the right data on a table with an similar expression:
filters
| essql query="SELECT geo.dest, COUNT(distinct geo.src) FROM kibana_sample_data_logs WHERE geo.dest IN ('AU','CA') GROUP BY geo.dest HAVING COUNT(distinct geo.src) > 20"
| table
| render
Than if you are getting the right data table out of your logs, create a new canvas pie chart, change the essql function with the correct one and than the last thing you have to do is to create a link the columns with the piechart variables on the piechart style panel
Thank you for your help but when I create a new canvas and add element either Pie Chart or Table and try |essql query it gives me an exception with exclamation mark and message:
Expression failed with the message:
[essql] > Can not cast 'datatable' to any of 'filter'
Seems that you are mixing a bit the things up. Each function output filters,esdocs,pointseries is piped to the input of the next one and you are mixing few things in a wrong way.
First of all you should rewrite it as
Ouu thank you very much! Now I see a little bit better how it works
filters
| essql
query="select num1.keyword from dataframelast where suffix.keyword in ('mt','dn') group by num1.keyword having count (distinct suffix.keyword) = 2"
| pie
| render
With this query I can see id numbers of messages that have both suffix and if I apply it on Pie chart I see one coloured chart with correct result.
Do you have any idea how can I incorporate there the other messages with different colour in the same Pie as I mentioned in my first post?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.