Dynamically created charts (unknown data)

Can Kibana operate on unknown data?

A simple example:

Logstash imports from an SQL database. The database contains a table with, let's say, names of fruits, how many there are of each at a given date:

apple 2018-07-01 0
apple 2018-07-02 1
apple 2018-07-03 0
apple 2018-07-04 3
pear 2018-07-03 0
pear 2018-07-04 1

Now I want a visualization of the amount of apples over time. And the same goes for the pear, and so on. The key point being that the fruits are unknown. I just want charts for whatever is there, and that they are created automatically somehow (every morning would be sufficient).

Given the facts that you're advised not to use the .kibana ES index [1], and that the Kibana Saved Objects API is experimental [2], is poorly documented and has known issues [3]: How do I get Kibana to dynamically generate visualizations like this? Is it even possible? Or do I need a plugin?

[1] https://www.elastic.co/guide/en/kibana/current/saved-objects-api.html
[2] https://www.elastic.co/guide/en/kibana/current/saved-objects-api-get.html
[3] https://www.elastic.co/guide/en/kibana/current/saved-objects-api-create.html

Have you tried making a split chart. A split chart will create a new chart per bucket returned by an aggregation. In your case, you could split with a terms chart on the fruit field. That way you would have a chart per fruit term.

Below is an example of a split chart where the splitting is done one the machine os field.

Thanks for you response, Nathan. Your suggestion results in one visualization for all fruits though. What I need is one visualization for each fruit. The fruit example is an analogy for something that there's hundreds of; all of them in on one page is neither useful, nor efficient.

Furthermore, they will be multiplied by other factors (also of unknown values). The instruction will be something like "for all X, on Y, with Z, create a chart".

Is this just not a thing that Kibana is capable of?

You can open an feature request.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.