Discover option Filter - Range based on DeviceID

[joedbadmin (Jose Mathew)]

Hi Experts,

I was trying to create a report using DISCOVER menu.
The index got 8 million records and one of the fields is DeviceID

If I choose the 'exists' as filter and field DeviceID; I get all the 8 million records.
I want to limit this based on ranges, such as
DeviceID >10K and DeviceID <500K

How's it possible? I wanted to export that in to a csv then.

When I try to export without such a range, it seems like it's taking so much time (running for over 20 hours now). I'm unsure why (just a integer field 8 million records) taking over 20 hours plus for the csv export.

Please help.

[joedbadmin (Jose Mathew)]

The current filter is

{
"exists": {
"field": "DeviceID"
}
}

I want to add add something like the below to this filter or a new filter in this DISCOVER option

{
"exists":{
"field": "DeviceID"
"gte" : 10000,
"lte" : 500000}
}

Any ideas?
Is range possible such as > and < on an inteer field?
I'm a newbie to ES / Kibana.

[tsullivan (Tim Sullivan)]

1. You'll need to create a saved search with the filters. See https://www.elastic.co/guide/en/kibana/current/save-open-search.html#save-open-search
   • Filters can be part of a saved search. See the docs on filters to translate your requirements to the Kibana features available:
     • Kibana Query language: https://www.elastic.co/guide/en/kibana/current/kuery-query.html
     • Lucene query Syntax: https://www.elastic.co/guide/en/kibana/current/lucene-query.html (Especially that this option also allows Elasticsearch Query DSL)
2. With Kibana Reporting, you can export the results of a saved search from Discover as CSV. With a Basic license, the Share menu in Discover will have an Export > CSV option.