Filter the metrics column

Hello,
I created with TSVB a table with two columns. The table displays the date of the last document of each server (Top hit..).

server 2 | 2022-06-15
server 2 | 2022-06-15
server 3 | 2022-06-12

I would like to filter the date column (or the whole table) to display only the servers whose date is older than one day, like this :

server 3 | 2022-06-12

I.e. to see the servers that have not sent anything for more than one day.

This is actually a filter on my metric (top hit) that I would like to do, but the filters are applied before the metric and not after.

How can i do this ? Is TSVB the best way ?

Thank !

Hi @GinkoLucas ,

what version of the stack you have?

Hi @Marco_Liberati,

It's v8.1.2

I think what you could do in TSVB is to declare a filter on the date field with the is now between:

In the example above I'm showing only results older than 1 hour from now.

Or as an alternative you can use Lens and declare a my-date-field < now-1d as in this example:

Thank you for your answer.
It doesn't work, maybe I misspoke.
Applying a filter like this will filter the data set and not the metric directly. This means that my table will show me the last data received older than one day for all server.
For example, let's imagine this :

this is my dataset :

server 1 | 2022-06-15
server 1 | 2022-06-14
server 1 | 2022-06-13
server 2 | 2022-06-15
server 2 | 2022-06-14
server 2 | 2022-06-13
server 3 | 2022-06-13

I would like this :

server 3 |2022-06-13

your way of doing things give me this :

server 1 | 2022-06-13
server 2 | 2022-06-14
server 3 | 2022-06-13

To be clearer, basically I would like to display the servers that have not sent me a log for more than a day. And i would like to see the date of the last document.

I see what you mean.
I think there's currently no way to hide it, but there's already a ticket for this feature request you can track the progress here: [Lens] Table Allow for Filtering of Rows on the string Column Value(s) · Issue #122170 · elastic/kibana · GitHub

1 Like

Okay Marco,

Thanks for your help !
:slight_smile: