Kibana Canvas

Elastic Stack Kibana
1

Hello,

I have a dashboard with a Pie, including some filters to specify the Slices of the pie.

I want to build the Pie in canvas, but I don't know how. Can someone guide me a little bit, with some hints....how to get the filters for the slices in a canvas Pie.

I allready studied the online documentation, some example make it more clear.

Thanks.

Greeting,
Robin

2

Not sure what you mean for filters to specify the Slices of the pie but assuming you want to aggregate some index by a field and get the count of documents per field value and then filter out some values you want to hide, I think you can use the filterrows function in Canvas or maybe simply put a WHERE condition in your SQL clause.

In this screenshot I get from the flights sample data set a count of documents per Carrier and then in the expression editor I added a filterrows to only keep those for JetBeats and ES-Air

image
image1534×1135 104 KB

But as I was mentioning, you can do the same from the source just adding a WHERE clause

image
image1536×1102 100 KB

Does this help?

2 Likes
3

It's also important to note that you can use the pie visualization from the Dashboard directly on the Canvas. You can either save it to the visualization library, and use the Add from library button on the workpad, or create the pie chart again in Lens or Visualize by navigating to the editor directly from the Canvas top bar, then pressing Save and return once you've configured your pie chart.

3 Likes
4

This is a really good one to remember, thank you :slightly_smiling_face:

5

Yes, this helped me, I need to understand the way off thinking with canvas.

I only need to combine two or more values to one slice.

Lets say I have a column with multiple values: 1,2,3,4

Then I want to add the values 1 in one slice and the values 2,3 grouped in one slice and 4 in one slice.

Thank you for your assistance. :slightly_smiling_face:

6

This Canvas expression worked for me with the sample flights dataset

kibana
| selectFilter
| essql 
  query="SELECT Carrier, count(1) as count
FROM \"kibana_sample_data_flights\"
GROUP BY Carrier"
| mapColumn name="newCarrier" id="newCarrier" expression={
  if condition={getCell Carrier | any {eq "JetBeats"} {eq "ES-Air"}}
    then= "JetBeats and ES-Air"
    else= { getCell Carrier }
}
| pointseries color="newCarrier" size="sum(count)"
| pie
| render

It uses mapColumn to define a new column in the data table that merges the rows for JetBeats and ES-Air. Then you also need to change the pointseries call to use the sum(count).

image
image884×993 52 KB

7

I fixed it with a CASE function, worked good.

I don't know if this is off topic, but I do have a last challenge to solve, and I think I need the mapColumn for this but I do not exactly know if it is possible.

Let me tried to explain it:

I have a table, table A, inlcuding names, created with an ESSQL query from index A, I need to check if the names in that table are in another INDEX, INDEX B. And I want the result in a column in A. I'm stuck, I think I need to use the getCell function, that you used aswell and pipe it to an other ESSQL query to perform the search, but it is not working, I miss something. This is what I have so far:

| essql 
  query="SELECT target as Hosts FROM INDEXA WHERE \"@timestamp\" >= (TODAY() - INTERVAL 7 DAY)"
  mapColumn name="Amount" id="Amount" expression={getCell Hosts | essql query='SELECT count(Bug) FROM "INDEXB" WHERE \"@timestamp\" >= (TODAY() - INTERVAL 7 DAY) AND target = Hosts'} 
| render

I get the error:
[essql] > Unknown argument 'name' passed to function 'essql'

In the end I want add a couple columns like this and make a Pie out of it.

8

Maybe you are lacking a | before the mapColumn statement?

Also, using render as=debug seems to be useful to see the data structures (I just learnt this today :sweat_smile: )

1 Like
9

Yes, I checked it, it is there

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.