Element involves results from two KQLs?

Elastic Stack Kibana
1

Hi, in Kibana Canvas, I want to have an image element that changes color according to results from two separate KQLs. Is it possible? If not, any suggestions on how I may be able to work around this limitation?

Thanks a lot.

2

This sounds like a use case for canvas. There you can have multiple queries and using conditionals to decide about how to reflect the data in your visualizations.

Is using canvas an option for you?

Otherwhise also vega could work for you in a normal dashboard.

3

Actually I am using canvas. Here's what I am currently doing to control color of the image element in canvas based on 'data_source1', but I need to modify it so that it will also depend on result from another query, e.g. name = 'data_source2'.

Is there a way I can do that? Thanks.

filters group="img_group1"
| essql 
  query="SELECT overallStatus FROM \"index*\"
WHERE name = 'data_source1'
ORDER BY \"@timestamp\" DESC
LIMIT 1"
| getCell "overallStatus"
| image 
  dataurl={switch case={case if={eq "error"} then={asset "asset-a5081913-6583-4748-81a2-58f13bf64747"}} case={case if={eq "warn"} then={asset "asset-c268a80c-fc5f-44b9-81b2-96b473fd2fd4"}} case={case if={eq "OK"} then={asset "asset-059c3593-b70f-4fa0-90c3-292b09086fd6"}} default={asset "asset-a5081913-6583-4748-81a2-58f13bf64747"}} mode="contain"
| render
4

Okay thats looks already pretty good.
For a second query I would recommend using variables.

This canvas board is a good example for that kind of job:

5

Thanks, Felix. I'll take a look at variables.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.