Custom elastic query with Enhanced Table

Elastic Stack Kibana
1

Continuing the discussion from Enhanced Table:

Kibana Datatable has some limitations. I am using aggregations with a custom elastic query for generating results and sorting on the basis of buckets can Enhanced table give freedom to use custom query like we have in Vega

2

I am not very familar with the enhanced table plugin.Maybe @fbaligand can help here but can you give us more information on what exactly do you want to do? You don't want to use an index pattern but an ES search query instead?

3

I’m sorry but Enhanced Table does not manage full ES queries.
That said, in filter bar, you can edit filter and enter your custom query using full ES DSL possibilities.

I already used that to make parent/child queries.

4 
{
  "aggs": {
    "time_buckets": {
      "terms": {
        "field": "vehicle"
      },
      "aggs": {
        "max_ctd": {
          "filter": {
            "range": {
              "CTD": {
                "gt": 0
              }
            }
          },
          "aggs": {
            "max_ctd_agg": {
              "max": {
                "field": "CTD"
              }
            }
          }
        },
        "min_ctd": {
          "filter": {
            "range": {
              "CTD": {
                "gt": 0
              }
            }
          },
          "aggs": {
            "min_ctd_agg": {
              "min": {
                "field": "CTD"
              }
            }
          }
        },
        "CTD": {
          "bucket_script": {
            "buckets_path": {
              "max_ctd": "max_ctd>max_ctd_agg",
              "min_ctd": "min_ctd>min_ctd_agg"
            },
            "script": "params.max_ctd - params.min_ctd"
          }
        },
        "max_cteu": {
          "filter": {
            "range": {
              "CTEU": {
                "gt": 0
              }
            }
          },
          "aggs": {
            "max_cteu_agg": {
              "max": {
                "field": "CTEU"
              }
            }
          }
        },
        "min_cteu": {
          "filter": {
            "range": {
              "CTEU": {
                "gt": 0
              }
            }
          },
          "aggs": {
            "min_cteu_agg": {
              "min": {
                "field": "CTEU"
              }
            }
          }
        },
        "CTEU": {
          "bucket_script": {
            "buckets_path": {
              "max_cteu": "max_cteu>max_cteu_agg",
              "min_cteu": "min_cteu>min_cteu_agg"
            },
            "script": "params.max_cteu - params.min_cteu"
          }
        },
        "max_cter": {
          "filter": {
            "range": {
              "CTER": {
                "gt": 0
              }
            }
          },
          "aggs": {
            "max_cter_agg": {
              "max": {
                "field": "CTER"
              }
            }
          }
        },
        "min_cter": {
          "filter": {
            "range": {
              "CTER": {
                "gt": 0
              }
            }
          },
          "aggs": {
            "min_cter_agg": {
              "min": {
                "field": "CTER"
              }
            }
          }
        },
        "CTER": {
          "bucket_script": {
            "buckets_path": {
              "max_cter": "max_cter>max_cter_agg",
              "min_cter": "min_cter>min_cter_agg"
            },
            "script": "params.max_cter - params.min_cter"
          }
        },
        "Energy Usage Per Km": {
          "bucket_script": {
            "buckets_path": {
              "ctd": "CTD",
              "cteu": "CTEU"
            },
            "script": "params.cteu/params.ctd"
          }
        },
        "Regenration %": {
          "bucket_script": {
            "buckets_path": {
              "cteu": "CTEU",
              "cter": "CTER"
            },
            "script": "(params.cter/params.cteu)*100"
          }
        }
      }
    }
  },
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "datetime": {
              "gte": "2022-05-20T08:00:00.000Z",
              "lte": "2022-05-21T08:30:13.184Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "filter": [],
      "should": [],
      "must_not": []
    }
  },
  "runtime_mappings": {}
}

This is my elastic query it includes bucket script bucket sort and aggregation filters i want to show it as a datatable vega-lite working fine for me but it doesn't have a table view

5

does this really work for aggregations as well ??

6

In Lens data table you can give a different filter per metric as you can see in the screenshot below so I guess you could use it for your use case.

image
image2882×1442 365 KB

7

Thank you so much for your suggestion. 1 more question can i use bucket script as well in lens data table ??

8

Screenshot from 2022-05-23 16-25-57
Screenshot from 2022-05-23 16-25-571534×585 71.1 KB

Like i want to subtract these 2 metrics

9

No unfortunately we don't support bucket script. Can't you use formula like that?

max(cto) - min(cto)
10

:frowning: Different Metrics have a different set of filters. Do we have any third party table plugin to achieve this ??

11

you can write the filter in each formula perhaps?

max(cto, kql='myMetric: "filter"') - min(cto, kql='myMetric: "filter"')

1 Like
12

Exactly for the formula metric you can do what Graham proposes. For the other two metrics as I told you above, you can select Advanced options and then Filter by to add your filter.

13

Let me try these and will get back to you

14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.