Iterate over array in Kibana

[SBH]

Hi

I have 3 docs as shown below. It contains the tasks array. I want to have a hit fx in a count for each time the status for the task i fx started.

When i search for this in Discover: tasks.status.keyword : "Started"
I only get 1 hit, but i want to iterate over the tasks array, and get 2 hits. I understand that i can't do that in Discover cause it only returns docs. But in i a visualizatin i would like to show that there is 3 tasks overall with the status 'Started'. Any suggestions?

Thanks in advance.

JSON:

{"instanceId": "1","tasks": [{"id": "100","name": "Task 100","status": "Closed"}, {"id": "101","name": "Task 101","status": "Received"}]}
{"instanceId": "2","tasks": [{"id": "102","name": "Task 102","status": "Closed"}, {"id": "103","name": "Task 103","status": "Received"}]}
{"instanceId": "3","tasks": [{"id": "104","name": "Task 104","status": "Started"}, {"id": "105","name": "Task 105","status": "Started"}, {"id": "106","name": "Task 106","status": "Started"}]}

[markov00 (Marco Vettorello)]

Hi @SBH
Kibana doesn't already compute visualization of aggregation for nested objects https://github.com/elastic/kibana/issues/1084
A workaround approach is to flatten your document structure into documents that describe a single Task object

[SBH]

Hi @markov00

Yes i already did that and that worked fine, but in order not to have to many indexes, it would be nice to kind of iterate over the tasks object like an enumeration, if this is possible. So my question is, what would be the most correct approach, do some kind of mapping so that the tasks object is an array?`

Regards

Søren

[markov00 (Marco Vettorello)]

It's possible to map the array as a nested object and query them via ES (https://www.elastic.co/guide/en/elasticsearch/reference/current/nested.html) but currently Kibana visualizations don't support nested fields aggregation

[SBH]

Hi,

Yes i see, so if you need to display it in a Kibana Dashboard, another index is needed.

Is it possible to create a new index from an already created index?

What i mean is, if the situation occurs, that a new dashboard is needed, and the right index is not there, can you create that index from a 'main' index and flatten the new index?

I mean if the data just isn't there anymore from the main system?

Or what is best practice here?

Regards Søren