# Elasticsearch queries in kibana

**URL:** <https://discuss.elastic.co/t/elasticsearch-queries-in-kibana/16056>\
**Category:** Elasticsearch\
**Created:** [February 27, 2014, 5:38pm UTC](https://discuss.elastic.co/t/elasticsearch-queries-in-kibana/16056 "2014-02-27T17:38:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![computer\_engineer](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@computer\_engineer](https://discuss.elastic.co/u/computer_engineer)\
**Post date:** [February 27, 2014, 5:38pm UTC](https://discuss.elastic.co/t/elasticsearch-queries-in-kibana/16056/1 "2014-02-27T17:38:38Z")

</div>

I have setup a dashboard that displays incoming message rates in a graph,  
filtered terms in a pie graph and all with nothing really to do. I want to  
be able to display a table/graph or some other type of panel to display  
elapsed time between two datetime fields that appear in my message:

\*{"pubDate":"2014-02-27T07:11:44", "fetchDate":"2014-02-27T07:11:55", "client":"ME", "query":"(work  
OR my job boring OR mundane OR stodgy OR interesting OR sucks OR  
exciting OR fun)", "lang":"en"} \*  
What I am able to get now is a language filter graph, and a query filtered  
pie chart with the normal incoming rate graph as well. I want to create a  
graph/table that gives the difference between the pubdate and fetchdate. I  
found some suggestions as follows:

\*script\_fields, which allow calculations with dates: curl -XPOST  
localhost:9200/test/test/\_search -d '{"query":{"match\_all":{}},  
"script\_fields":{  
"interval":{"script":"doc["fetchDate"].value-doc["pubDate"].value"}}}' \*

The problem is that my first and only implementation has been a basic conf  
to consume all messages and then creating the queries and panels in kibana.  
All simple queries and I can view the json script when clicking on the  
inspect button but not sure how do I create the same query in Kibana to  
display in a table.

Also related to same project is that the query field does not work  
correctly in that elasticsearch seems to break long queries into individual  
terms and I wonder if it interperates the OR itself or just based on  
length.  
For example I set up a bar graph to display the counts of the most common  
values for a field query with examples like these:

(work OR my job boring OR mundane OR stodgy OR interesting OR sucks OR  
exciting OR fun)

But it displays each single query: more powerful than I want.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/831d1fbe-b9ee-4db6-aa35-103a6a3d2a5f%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/831d1fbe-b9ee-4db6-aa35-103a6a3d2a5f%40googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:46am UTC](https://discuss.elastic.co/t/elasticsearch-queries-in-kibana/16056/2 "2017-07-06T01:46:51Z")

</div>