How to use variable in canvas

Hi,

I am trying to use canvas variable's within ESQL query and cannot work out the syntax, I have it working within Markdown but cannot work it out within my query, I've searched the support and discuss and tried a number of examples but cannot get it to work.

WHERE "@timestamp" > TODAY() - INTERVAL 30 DAY AND organization.name={var "Org"}

I managed to get this working, I needed to modified my query in expression editor and modify the query to

query={string"

When using the gui it misses out the {string

2 Likes

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.