Custom background filter

[Red_Thomas]

I'm trying to create a visualization using significant terms and I'd like to customize the background filter. Anyone have an idea on how to do so easily in Kibana?

Basically, I'd like to have a query where the foreground set is last hour, and background set is the same hour on the day of the week for the last four weeks.

The ES query is pretty straight forward. Getting it to work in Kibana is what's giving me some problems.

Thanks!

[bhavyarm]

Hi,

Its not possible right now. Can you please log a feature request here and please let us know which visualization you want this to work on? https://github.com/elastic/kibana

Thanks,
Bhavya

[Red_Thomas]

Wilco. Seems like adjusting the background set ought to be available for any of them, though. Anytime you use significant terms, there's a chance you're going to want to adjust the background set. Especially when you're looking for significance when comparing like-with-like.

Thanks!

[Red_Thomas]

Done, and appreciated.

Thanks for the quick answer.

Issue: Custom Background Sets for Significant Term Queries

[Red_Thomas]

I wanted to update this with an answer. It turns out this is possible using the JSON Input under the advanced options in the query. I'd tried and turns out it wasn't working because I flubbed the custom query.

Here's a working example:

Query

{
"background_filter" : {
"bool" : {
"should" : [
{
"range": {
"@timestamp": {
"gte": "now-1h/h",
"lte": "now/h"
}
}
},
{
"range" : {
"@timestamp" : {
"gte" : "now-25h/h",
"lte" : "now-24h/h"
}
}
},
{
"range" : {
"@timestamp" : {
"gte" : "now-49h/h",
"lte" : "now-48h/h"
}
}
},
{
"range" : {
"@timestamp" : {
"gte" : "now-73h/h",
"lte" : "now-72h/h"
}
}
},
{
"range" : {
"@timestamp" : {
"gte" : "now-97h/h",
"lte" : "now-96h/h"
}
}
}
]
}
}
}

I setup the visualization using significant terms to look at DNS queries and limited the query to the last hour. The background filter then combines the last hour and the same hour of the same day of the week for the last four weeks.

This results in significant terms that account for normal fluctuation in user activity.

Compliments to Tim Roes for his answer to my feature request on the github page, which directly helped me to get this sorted.