@apt275, there is a slightly hacky way to accomplish what you want, but maybe you can use it as a starting point. Thanks @lukas for the suggestion.
So, the problem is that the timepicker will affect all visualizations that are timebased. If you want a view of your data that is independent of the timepicker, then you have two options that I can come up with.
-
(which is the most removed from what you're asking) is to create a second dashboard that is dependent on a larger date range, and save the dashboard selecting the
Store time with dashboard
option. You would then need to mitigate showing both dashboards on your screen in some way. This is obviously less than ideal. -
Create a second index pattern against the same elasticsearch index that isn't timebased.
- If your current timebased index pattern is
logstash-*
, then create a second non-timebased index pattern oflogstash-**
- Create your Metric visualization using this second index pattern to get a running count of the documents in your index
- Include this new visualization on your existing dashboard.
Because the new visualization is not based on timebased data, it will be unaffected by the timepicker. Please let me know if that works for you.