How to compile a dashboard with filter and nested jsons

Hello everyone,

I have an index with nested json and would like to build a dashboard with filters being applied to both parent and nested json. Kindly let me know if there is a way to accomplish that. Details below.

Below are the indices I have:
{
"id": 1,
"collection": "Technical documentation",
"document": "MyFirstDoc.txt",
"checked": "2019-02-25",
"status": "Valid"
},
{
"id": 1,
"collection": "Science Fiction",
"document":"MySecondDoc.txt",
"checked": "2019-02-26",
"status": "Has problems",
"problems": [
{ "problem": "Spelling", "count": 100 },
{ "problem": "Punctuation", "count": 15 },
{ "problem": "Problem Y (the set of problems is not known beforehand)", "count": 3 }
]
},
{ ... }

I need a following dashboard:

  • A line chart plotting "status" (term) by "checked" (date) - OK
  • A table with columns: "collection|problem|count" - OK
  • A filter by "checked" (date) for both visualizations - OK
  • A filter by "collection" (term) and "problem" (term) for both visualizations - FAIL

The goal is to manage to apply the filter to both views. The approaches I have in my mind:

  • Use Nested Objects, but they doesn't seem to be working
  • Flatten the structure, but first of all it doesn't make much sense since "problems" might be absent, second it is going to explode my data and data reload time might become an issue for me, and last but not least is that I will most likely require a uniq count which might not be exact
  • Split into two documents - the way I do it today. I managed to apply the date filter to both views, but have issues with using same "collection" and "problem" filters for both views.
  • Split into two dashboards - I don't see technical problems with that approach, but it violates the system requirements and I would like to leave it as a very last option.

Please let me know how would you solve the problem.

Thanks for everyone!

Using nested JSON is notoriously difficult in Kibana (as you already said), so you will need a work-around.

imho, for now option 2, 'flatten the structure', is probably your best bet, as this is how most users index their data when they want to build dashboards with Kibana.

Thank you for response. Let me clarify one thing. If we proceed with denormalized approach, then it will most cause inaccuracies with Unique counts, eg. in case we need to calculate count of docs with errors by day

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.