Filtering the data list from Discover to only see Unique Ids

[bailarch]

Hello guys - not sure if the subcategory for this issue is docker (not sure what this is but the other options seem incorrect for me)

I am trying to get the list of all the users name from Discovery.
However I am seeing multiple / duplicate values but there is no 'filter out duplicate' from filter function. I was trying to google or try different ways to have only unique ids or get rid of all the duplicate values but no good.

Can anyone help me how to filter unique IDs only for discover or dashboard data list? Thank you.

[bhavyarm]

Hello,

So you cannot do it in discover. But can you please try lens?

Kibana Lens

The data table in it might give you exactly what you need.

Thanks
Bhavya

[bailarch]

Hello,

Thank you for the response. The reason why I moved on to Discover is because Dashboard only shoes you 100 values max and the rest go into 'Other' - Please see the image below.

Is there a way where we can 'explode' or expand out those values from others?

Thank you very much

[bhavyarm]

Hi,

When the rest go into "other" that means some documents in your database don't have field value for user.name. Kibana is displaying that correctly.

You can check for it by making a filter on other and go to discover and inspect those documents.

Thanks
Bhavya

[bailarch]

Thank you for the response

However the amount of values that I can see from Dashboard - Lens is max 100 though right?
Thats the max value that I can put in from the setting page.

[ghudgins (Graham Hudgins)]

The lens 100 limit was increased to 1000 in 7.13 I believe

[stephenb (Stephen Brown)]

Slight correction for clarity

Kibana is displaying correctly

However other is the sum of all other documents with user user.name values that are not included in the Top N

If user.name field does not have a value it is not included in the table / aggregation.

Lens will work the same way.

[bhavyarm]

Thanks @stephenb I confused the other bucket with missing in traditional xy vizs
Your answer clarifies it.

[bailarch]

hello Thank you for the response but my lens limit is still set to 100. Is there a way where we can update the version?

[rcowart (Rob Cowart)]

@bailarch In my opinion Lens is probably the worst of all of the Kibana visualization options, and the wrong choice for what you want. I recommend using the plain data table visualization. You can set the size of the result set in a bucket to whatever number you need. In this case I set it to 50000 and I am displaying 20 rows per page. You see that I have 1347 pages of results in my data.

[bailarch]

Hi !

Thank you for the response - I thought the same and realized Visualization option is better. However my concern is I don't know how to create one. I've been looking into the templates that Elastic Cloud create but wasn't able to make my own. Do you perhaps know where I could find the guideline to make data table visualization?