Filter applied to specific data view (index pattern)


I find it powerful to mix content from different types of indexes in Kibana dashboards, but have a difficult time setting up useful dashboards because of global filtering. I do however want to use filters and add controls for easy selection of content to view.

A recent example is that I want to compare a set of collected values in an index matched by data_view_a with reference lines based on values in an index matched by data_view_b. data_view_a and data_view_b don't have many filed in common, and as soon as a filed specific to one data view is included in the filter everything related to the other is filtered out.

What would help is the possibility to have filters targeting only a specific data view. For example a query on the form data_view_a.source : source_1 and data_view_b.reference_set : reference_set_2 or similar constructions for other types of filters.

The best solution I've found so far is to add missing fields to my data views, emitting a fixed value which will never occur in the real data from that field in other data views. Then I include that value among the ones to filter for. But if I want include more data views along with specific filters it quickly becomes cumbersome.

I'm quite new to Kibana, so maybe I'm doing things backwards and that there are better ways of solving this. Yet I find others having similar issues that indicate some feature may be missing.
One example is Apply filter for individual visualization in dashboard

Any ideas for how to better achieve what I want to do?

The advanced setting courier:ignoreFilterIfFieldNotInIndex could help with this.

1 Like

Great! This sounds exactly like what I'm looking for. Enabling it being in the advanced setting makes me think that there can be some unexpected side effects though.

What is Kibana looking at to determine if a field exists or not? Actual data in index, mapping, data view...?

Could I get more data than expected if I have daily indices and a field that only exists in documents a few times a month?

It's looking at the combined mapping of all indices matching the index pattern of the selected data view (irregardless whether they are actually hit by the current query or not)

Perfect! Tried this out now, and it was just what I needed!


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.