Filter Visualizations on a Dashboard using the default time range (dashboard upper right corner) on filter conditions using fields other than index pattern primary time field

Elastic Stack Kibana
1

Hi, is it possible to have a multiple "Time Field" index pattern ?.
I would like to use the default time filter in a dashboard to filter dynamically 3 visualizations this way:

Index pattern time field = field1*
Dashboard time filter: 01/05/2021 - now = mainFilter

Visualization1 filter: field1* between mainFilter
Visualization2 filter: field2 between mainFilter
Visualization3 filter: field3 between mainFilter

Is this possible ?. Any workaround ?.

2

I think there are two options here:

  1. Create three different index patterns with field1, field2 and field3 as default time field and build your visualization with the "correct" one. You can't really give them nice names, a hack I used a bunch of times is to add a second index name to the pattern which doesn't get matched and serves as a comment. Like if your indices are called mydata-*, then name it mydata-*,(field1 based), mydata-*,(field2 based) and so on. It will match the same actual indices, but you see right away what it's about
  2. If your visualizations contain a date histogram, consider using the Lens visualization type. it will actually do this automatically - if you use a time field which is not the default for a date histogram it will bind the main filter to that field instead of the default time field. For visualizations without date histogram this won't work, it will fall back to the default time field.
1 Like
3

Hi, thank you for your answer.
In option 1. Can you explain what you mean when you say "add a second index name to the pattern which doesn't get matched" ?. Do I need to create another index copy of the original and duplicate data ?.

4

I was just refering to the ,(field 1 based) suffix to the index pattern. Elasticsearch allows to list multiple indices separated by comma for a pattern definition (index1, index2), option 1 is abusing this for putting a comment in there for an index name that will never be matched. You don't need a separate copy of your data.

5

Thank you Joe, just to conclude this thread, I've implemented the two options, and all worked fine.

Main index: mock_sms

Option1:
Defining 3 Index Patterns this way (without spaces after comma):

mock_sms*,fecha ─────────► fecha default Time field in index pattern
mock_sms*,fechaRespuesta ──► fechaRespuesta default Time field in index pattern
mock_sms,fechaRecepcion ───►fechaRecepcion default Time field in index pattern

then I've implemented 3 different visualizations, each one pointing to each of previous index patterns. Finally, I loaded the three visualizations in a new dashboard. Now, every time the default date in the dashboard is changed, also change the date scale in the three visualizations at the same time.

Option2:
I've implemented three visualizations, each one with the three date fields above using Lens:
Visualization1 - X Axis: fecha
Visualization2 - X Axis: fechaRecepcion
Visualization3 - X Axis: fechaRespuesta

and loaded in a new dashboard. The dashboard behaves the same as in Option1.
The only drawback in Option2 is Lens does not allow too many customizations in visualizations. For example: Change format of labels in a visualization X axis chart
Perhaps Lens needs more time to get more customization features.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.