How to filter visualization based on result of aggregate?

Elastic Stack Kibana
1

I'm trying to create a variety of visualizations based on aggregates. The index is holding financial transactions, and I'm looking for accounts with outstanding balances. The simplest visualization is a data table that splits rows into buckets based on terms. I'd like to exclude all of the buckets/rows where the sum of a field is zero. Based on my reading, I believe that this is not possible.

How can this be shown in Kibana?

Steven

2

@thomasneirynck can you please advice here?

Thanks
Rashmi

3

hi @Steven_Ensslen,

this is similar to a HAVING clause in SQL.

Elasticsearch has something called a "bucket selector": https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html. This is likely what you'd want to use.

This functionality is not available in Kibana though. There's an open ER for that: https://github.com/elastic/kibana/issues/11167.

If you think that's in-line with what you need, I would go and upvote that ticket.

If you are willing to get down and dirty, you may be able to work around this limitation by creating a Vega-visualization. Vega is a declarative languages for visualizations, and it can handle rudimentary tables (e.g. https://vega.github.io/vega-lite/docs/text.html#text-table-heatmap). Kibana has a plugin in 6.2, and it allows you to put in the raw ES-query for your data (https://www.elastic.co/guide/en/kibana/current/vega-graph.html). This is an experimental feature in Kibana, but may be worth checking out.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.