Custom search

Elastic Stack Kibana
1

Hi,

I have created a search in Sense that i would like to use in Kibana it that possible?

Search:

GET logstash-duplicates-2016.01/_search
{
  "size": 0,
 "aggs": {
        "duplicateNames2": {
            "terms": {
                "field": "MD5checksum.raw",
                "size": 750,
                "min_doc_count": 2,
                "order": {
                  "name": "desc"
                }
            },
            "aggs": {
              "name": {
                "sum": {
                  "field": "Size"
                 
                }
              }
            }
        }
    }
}
2

Not directly, no. You'll have to re-create the query using the agg builder in Visualize - that is, the interface on the left side there.

Things like min_doc_count we don't offer controls for in the interface, but if you click the Advanced link at the bottom, it will expose a JSON input, which you can use to add that to the terms agg, like { "min_doc_count": 2 }

To see that you have a match, click the green play button at the top to run the aggregation, and consult the spy panel below the visualization. Opening it will expose a Request area, which will allow you to see the exact request that was made to Elasticsearch.

NOTE: You won't see a Debug option if you are running a released build of Kibana

Alternatively, you could get something close, and then save it. Then, go in to Setting > Objects > Visualizations, find the vis you just saved, and edit the aggs section under visState. This is sort of a last-ditch effort though, and can lead to you breaking the visualization and putting Kibana into a weird (but recoverable) state...