Kibana dropdown filter doesn't handle results containing a dash (-)

Elastic Stack Kibana
1

Hi

I would like to report a this Kibana canvas issue.

Let me first describe the test environment:
The canvas contains a dropdown filter and a Data table.
The kibana index is issued from syslog files. The main index fields are:

  • host
  • filename
  • message

The dropdown filter allows the hostname to be selected with a very basic SQL command:

  essql query="SELECT host FROM \"linux-log\" GROUP BY host "
 | dropdownControl filterColumn="host" valueColumn="host" filterGroup="LinuxFilter"
 | render

The data table code is the following:

filters "LinuxFilter"
| essql 
  query="SELECT 
  \"@timestamp\" as \"Date / Time\",
  host,
  filename,
  message 
 FROM 
  \"linux-log\"
 "
| mapColumn "Date / Time" fn={getCell | formatdate "DD-MM-YYYY / HH:mm:ss"}
| table
| render containerStyle={containerStyle border="3px double #444444"}

Everything works fine with most of the hostnames.
But as soon as a dash is included within the selected hostname, the data table output is empty.

Note: I experienced the same issue with both V7.12.1 and V7.16.1.

A similar issue was reported in Feb. 2020 but not relevant solution was posted.

Thank you for your help

Vincent

2

Hi

I keep working on this issue and I made progress.

I added a DEBUG DATA object to get the JSON code.
And this shows the 'term query' keyword is used by the canvas to process the request (when the dropdown select is not 'ANY').

Then, in the "Dev Tools", the issue can be easily now reproduced.

This following request will correctly display all the 'frodon' host rows.

GET /linux-log/_search
{
  "size" : 1000,
  "query" : {
    "term" : {
      "host" : {
        "value" : "frodon",
        "boost" : 1.0
      }
    }
  }
}

This following request will display no result (and of course index-log contains 'the-hobbit' host rows):

GET /linux-log/_search
{
  "size" : 1000,
  "query" : {
    "term" : {
      "host" : {
        "value" : "the-hobbit",
        "boost" : 1.0
      }
    }
  }
}

I'm afraid this issue can't be fixed. Because there is no way to change the JSON code generated by the canvas...

Any ideas ?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.