How to make a master detail report in Kibana

Elastic Stack Kibana
1

I appreciate this isn't Kibana's usual use, but if I wanted to create a master-detail report in Kibana, how would I do so? By master detail report, I mean a data table style report where under each data row (perhaps showing totals by a large grouping, like country), there are a series of rows at a smaller level of aggregation (say by city) that show different data fields. Here is an example in another tool.

I've attempted this is vega, but I still haven't had any success with the syntax for multi-level aggregations.

I appreciate any suggestions.

2

Using the split table feature of data tables almost works for my master-detail requirement. There could be a prepared field or scripted field that included elements like field names, so that one prepared field had many sections like "Agent: Anne Client: Bruce". And totals could be enabled for the metrics displayed in the detail section.

I believe that data table based approaches can not aggregate fields other than the ones which appear in the detail section, as neither a prepared nor scripted field can have an aggregate in it.

3

The chart you linked to would definitely be possible if each document represented a "sale" and looked something like this:

{
  "category": "Beverages",
  "product": "Chai",
  "price": 6.00
}

Then, like you mention in your second comment, you could use a split data table, the metric would be the sum of price and the buckets would be "Split table: terms of category" then "Split rows: terms of product"

Without knowing what your data looks like I'm not sure how to adapt this example to your use case, but I hope that helps a little but. Maybe you can go into a bit more detail about what you mean by "I believe that data table based approaches can not aggregate fields other than the ones which appear in the detail section, as neither a prepared nor scripted field can have an aggregate in it."

4

I believe that the following is not possible in Kibana. For an index with two keywords and two integers make the following data table style visualisation. In the header section we have a terms aggregation on the first keyword with the sum of the first integer. In the detail section we have a terms aggregation on the second keyword with the sum of the second integer.

So if the data is

{ a: "de", b:"berlin",c: 1, d: 2}
{ a: "de", b:"berlin",c: 3, d: 4}
{ a: "fr", b:"paris",c: 5, d: 6}

The report is

de  4
----------
- berlin 6

fr  5
----------
- paris 6

I believe that nothing like this is simple example is possible in Kibana.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.