Kibana Graph linking does not work with filters

Hi I have a Kibana Metric Chart to show the ongoing High proprity incidents.

Here is the graph setup,

Below is the filter value i provided.


result.priority: 2 NOT result.state: closed NOT result.state: resolved

This shows my count correctly, but when i click on it, the rest of the graphs are not getting linked to show the value of the count selected.
If you see the below image, the graphs next to the metric chart, even after the filter is applied, doesn't show the filtered value.

Please help me find a solution.

Hey there Katara,

What version of Kibana are you using in those screenshots?

@poff, I am using version 7.2

Hey Katara,

In your query, what happens if you explicitly set the boolean AND in the query. So instead of

result.priority: 2 NOT result.state: closed NOT result.state: resolved

maybe try a query of:

result.priority: 2 AND NOT result.state: closed AND NOT result.state: resolved

@poff, I did this, unfortunately, it isn't working for me .

If you manually use that filter on the dashboard (not the metric), does it give you the expected results?


I tried to apply it seperately, ( i dont really know how to apply it full,

and the above works well.

I also tried:

result.priority.keyword: 2 AND NOT result.state.keyword: Closed AND NOT result.state.keyword: Resolved


Which also doesnt work

Hi ,
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Ticket_Type.keyword: Incident AND sla_met.keyword: "Not Met" AND SLA_Type.keyword: Response"

This is the query DSL for the filter i applied,

Is is any wrong?
Please help me solve this issue.

I have an alternative:
Filters do not work still, but the alternative is to have a aggregation based on terms and then apply the filters to the entire graph, this works for me.
You must have a terms aggregation and then any filter you apply tot he graph will allow you to link, this is mandatory.

You can apply any filters to further sort this down on top.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.