In an enterprise environment it's very common to have multiple running instances of same application(that you are develop).
For example we use ELK to monitor logs from our application that is deployed in many system environments: integration, UAT, production, functional testing, etc. And we have more that 5 instances for each category since there is needed to handle different versions in the same time.
The basic idea is that one ELK stack can be used for collecting data from multiple instances of same application, stored in the same index.
Now, at usage, you might have various visualizations and dashboards for visualizing data from an environment.
I would be real great if Kibana UI could be more flexible and offer a way to quick switch/filter between a configurable filter(an indexed field).
Please find below the following proposals for enhancing Kibana
Proposal 1 - global filter
I'm thinking on a filter similar to the "time range" that is global, and you don't have to include this filter in every visualize definition.
Kibana should be change in order to provide the following functionality:
- Configuration
Myself, I would prefer to be possible to configure in Kibana in Management, advanced Settings a global filter as follows:
globalfilter:enable - Boolean property that enables/disable the global filter
globalFilter:field - define the field to be used by the globalFilter
globalFilter:CustomLabel - the label of the global filter
globalFilter:defaultValue - the value to be used by default
-
Usage - Option1
When such a global filter is enabled, in KIbana UI, a new option shall be available on top bar (right on the left of the time button). This option shall display the currently selected value by the user of the globalFilter, or the default value if no value was selected
When used selects(clicks) this option, application shall display a popup (combobox) containing all possible values for the configured field to be used by the global filter. Value "ALL", or "NOT SET" should be also available by default. -
Usage - Option2
Alternative to option 1, would be to display this global filter in the "field" left menu, right under the Indexes option ( the option that allows to switch between indecses)
Proposal 2 - Filter
If proposal 1 - the global filter - is to difficult to realize, then I have a second proposal.
This filter shall be defined for each visualization. There will be a 3rd category of options for configuring a visualization, beside the "metrics" and "buckets".
In configuration left panel, where metrics and buckets can be configured, a new section shall be available, the "quick filter" that allows to add one (or multiple) quick filters.
The quick filter shall be configured by specifying a field to be used for filtering and a default label