How to filter visualization based on result of aggregate?

hi @Steven_Ensslen,

this is similar to a HAVING clause in SQL.

Elasticsearch has something called a "bucket selector": https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html. This is likely what you'd want to use.

This functionality is not available in Kibana though. There's an open ER for that: https://github.com/elastic/kibana/issues/11167.

If you think that's in-line with what you need, I would go and upvote that ticket.

If you are willing to get down and dirty, you may be able to work around this limitation by creating a Vega-visualization. Vega is a declarative languages for visualizations, and it can handle rudimentary tables (e.g. https://vega.github.io/vega-lite/docs/text.html#text-table-heatmap). Kibana has a plugin in 6.2, and it allows you to put in the raw ES-query for your data (https://www.elastic.co/guide/en/kibana/current/vega-graph.html). This is an experimental feature in Kibana, but may be worth checking out.