Filtering based on _index in kibana dashboard

Elastic Stack Kibana
1

I have multiple visualizations added to a dashboard. All visualizations use an index pattern 'raw_request*'.
Now my data comes in different indices like 'raw_requests_p1' and 'raw_requests_p2'.

So, in dashboard, I applied a filter as _index: "raw_requests_p1" to fetch only relevant records. But this does not fetch me any records. Is this not possible or I might be doing something wrong?

P.S. the individual indices do have records for the set time range.

2

Using the _index field seems to work on my local dataset, so it should be possible.

Are you creating a filter, or just adding that to the query bar at the top? Can you share a screenshot of what you're doing? Ideally with the filter open if it's a filter, like this:

29

3

So, I am using Kibana version 5.7
Also, I tried both ways and the results did not vary. Right now, I do not have access to my system, but its exactly like the way you have done in your screenshot. Except that, the 'index field is not a drop down but a text box'.

4

Fixed now!!
I had modified the visualization objects in kibana to now point to the index pattern 'raw_requests*' rather than 'raw_requests_p1' which was present before hand.
The changes got lost in b/w snapshot recovery and other operations on dashboard.
So, it works correctly now.
Also, later I still had similar issue which happened because I forgot to reapply mapping to one of the indices while recreating it.

1 Like
5

All visualizations use an index pattern 'raw_request*'.

Ah, so we were both operating under the wrong assumption here :wink:

Glad you got it working, and thank you for following up with the solution here!

6

Yeah, my bad. Patient debugging got it right. Thank you for helping out. Hopefully this will fix someone else's issue too.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.