How to know what Elasticsearch endpoint is used by Kibana to make graphs?

Elastic Stack Kibana
1

I have URI like
../discover#/?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now%2Fd,to:now%2Fd))&_a=(columns:!(_source),filters:!(),index:{index},interval:auto,query:(language:kuery,query:%27%27),sort:!(!(created_at,desc)))
at Kibana and it returns me hits total and hits per every half hour printed at bar graph.

If I'm right every bar returns difference between values per half hour.

I want to get plain data about it via command line.

What API Elasticsearch endpoint I should use to get such data?

I've tried to store ${index_name}/_stats/docs data but it doesn't match with Kibana graph data.

Endpoint /metrics has been used but it has different from Kibana graph values too.

2

Hi @philyeanaeknss ,

that is a little bit hard to reproduce in general.
To be honest my recommendation here would be to switch to ES|QL mode in Discover, then open the inspector and copy the request made for the visualization in there: at that point you can be 100% sure that the table returned by the ES|QL endpoint is the same used for the bar chart.

1 Like
3

Hm..
It is possible to copy request body only not its URI.

4

you are quite right.
I've opened an issue for it here you can track: [Inspector] ES|QL Request doesn't show URL in the Request panel · Issue #221581 · elastic/kibana · GitHub

5

So there's no any other way to find complete URL?

6

The URL is the Elasticsearch ES|QL /_query as described here: Use the ES|QL _query API | Elastic Docs

The request body can be used as is against that endpoint to get the visualization table.