Graph- time change

Elastic Stack Elasticsearch
1

Hi Guys,

We have recently purchased X-pack and we love the features in it , I can change the time frame in kibana when am using the discover feature but in graph i couldnt find the options to the change the time frame let's say i want to see only last 15 minutes and other time categories.

Any help much appreciated :slight_smile:

Thanks,
Raj

2

Hi Raj,
The Graph API has the option to use any query as a "guiding query" [1] to limit the scope of the documents considered when looking for vertex connections.

However the UI currently does not expose a clean way to define a choice of guiding query. One workaround is the search box will accept JSON strings if you want to pass the raw graph query expression, maybe as part of an automated call as in this example [2] but this will only help you load an initial graph and will not apply as you hit the "+" button to expand out from the connections loaded in the workspace.

If your scope is typically fixed (e.g. "now minus 7 days") then another option is to create a filtered alias [3] and use that alias name as your choice of index pattern. This will naturally filter the graph exploration to the set of documents that match that filter.

In future we hope to provide better UI controls over choice of time and any other form of filtering but hopefully these tips can provide an interim solution.

Cheers,
Mark

[1] https://www.elastic.co/guide/en/x-pack/current/graph-api-explore.html#CO82-9
[2] https://youtu.be/liMhiiyQ9co?t=19m46s
[3] https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html#filtered

1 Like
3

Thank you so much for the response :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.