# Kibana Home Dashboard showing critical In Red and Non critical Green **URL:** \ **Category:** Kibana\ **Created:** [January 31, 2024, 1:50pm UTC](https://discuss.elastic.co/t/kibana-home-dashboard-showing-critical-in-red-and-non-critical-green/352190 "2024-01-31T13:50:35Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![PRASHANT\_MEHTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prashant_mehta/32/101764_2.png) [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Post date:** [January 31, 2024, 1:50pm UTC](https://discuss.elastic.co/t/kibana-home-dashboard-showing-critical-in-red-and-non-critical-green/352190/1 "2024-01-31T13:50:35Z")
Hello All, Is there anyway I can transfer my Old implementaion to show HOME monitoring page to admins in this new way. This first approach is not required as per customer and asked instead for second approach that I don't think would be possible with kibana or canvas as past tried. This below image represent first approach, which shows all critical as per usecase ex Physical server or Tomcat as seperate usecases. When found anything critical then user click on link and redirect to dashboard. TSVB USED EVERYWHERE TO DO THIS. critical -Red, non critical - green. ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/afb87d7e644c598f8f13fd8ed4fa830299cdfc58.png) Customer instaed needs this second approcah, directly as per different usecases i.e diffrent indices. below image is required...Any of the metric is critical then Directly the Name should highligh as GREEN OR RED and Not metric. Not sure how to do this. How to show string value(RED OR GREEN), based on metric or may be some other way. New way that is needed: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/c/ec542619f1414f146934b1324e162db3520bf98c.png) ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [January 31, 2024, 3:16pm UTC](https://discuss.elastic.co/t/kibana-home-dashboard-showing-critical-in-red-and-non-critical-green/352190/2 "2024-01-31T15:16:48Z")
I imagine you have different indices for each of the groupings, so you may have, for example: - Index A, B, and C for the physical server - Index X, Y, Z for Tomcat - and so on To unify documents from different indices, you could add Elasticsearch [aliases](https://www.elastic.co/guide/en/elasticsearch/reference/current/aliases.html) for them to, following my example, get something like | Index | Group | Alias | | --- | --- | --- | | A | Server | `server_A` | | B | Server | `server_B` | | C | Server | `server_C` | | X | Tomcat | `tomcat_X` | | Y | Tomcat | `tomcat_Y` | | Z | Tomcat | `tomcat_Z` | Then you can create two data views: `server_*` and `tomcat_*`, and using [Runtime Fields](https://www.elastic.co/guide/en/kibana/current/managing-data-views.html#runtime-fields), create a new field that extracts the appropriate data to expose from each source. With these two things, I imagine you can use Lens with a fixed color palette like this: ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/c/ccea3fe38799837c3d3b9f563a5c92381ba8af88.png) The metric needs to point to an expression on a field to allow to set up a [drilldown](https://www.elastic.co/guide/en/kibana/current/create-drilldowns.html) so users can click on the metric and open a new dashboard. Hope this helps! ---
**Author:** ![PRASHANT\_MEHTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prashant_mehta/32/101764_2.png) [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Post date:** [February 1, 2024, 7:03am UTC](https://discuss.elastic.co/t/kibana-home-dashboard-showing-critical-in-red-and-non-critical-green/352190/3 "2024-02-01T07:03:14Z")
Hello @jsanz , Many thanx for your time to look into this. What I'm trying is deflecting from you suggested, at the end you're showing metric either green or red its already achieved. I will try and explain again. 1. I have many usecases which have there respective individual indices ex: tomact index, physical server index etc 2. Now from this index I have made individual dashboards which shows relevant visual, for example tomact dashobard shows: if tomcat is down,error count exceed etc. These are critical things that admins want to know. Same goes for other usecsaes 3. Now admin needs centralized dashborad that they will monitor through MONITOR, there they just need to see those boxes getting highlighted either in red)(if something critical-that is already there in individual dashboard) i.e String TOMCAT should be highlighted red if anything in that usecase reaches critical or exceeds threshold. 4. I have all the data and visuals done, the last point left is centralized dashbord which should just show- OK, TOMACT Is critical(in RED) else GREEN- from this admins will click on TOMCAT and see individual dashboard. Any of the metric that is showing critical in individual dashbord- ex some tomcat metric -error count, tomcat down, request count is critical then centralized dashboard should highlight TOMCAT itself in red, else green. The green and red boxes you see is ideal requirement. Already achived below:(Individual tomcat related dashborad), centralized dashboard are the boxes you see per Index.(The idea is admins will only go any check dashboards if someting critical is found , else not. That is the purpose of this new dashboard ) Physical server system.process.memory.rss.pct \> 0.1 system.process.memory.rss.bytes \> 1073741824 system.memory.actual.used.pct \>= 0.9 system.filesystem.used.pct \> 0.7 cpu.status : "critical" system.memory.swap.used.pct \>= 0.9 * * * Tomcat: tomcat.memory\_status : "Critical" tomcat.error\_status : "Critical" tomcat.request\_status : "Critical" tomcat.server\_status : "DOWN" Tomcat dashboard: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2a173375bc3bb959e4e02da894673732b8f13b6d.png) I hope I tried to convey it properly. Thanx ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [February 1, 2024, 11:45am UTC](https://discuss.elastic.co/t/kibana-home-dashboard-showing-critical-in-red-and-non-critical-green/352190/4 "2024-02-01T11:45:11Z")
I think I understood the requirements well. My broad suggestion was to combine aliases and runtime fields to unify data from different indices to produce a query that gives you the data needed to identify when something needs attention for each of the groups. Then you can use a Lens metric with a custom color palette to present that data, TSVB markdown, a Canvas workpad, or even a custom Vega visualization is more up to you I guess. Does this make sense? ---
**Author:** ![PRASHANT\_MEHTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prashant_mehta/32/101764_2.png) [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Post date:** [February 1, 2024, 3:24pm UTC](https://discuss.elastic.co/t/kibana-home-dashboard-showing-critical-in-red-and-non-critical-green/352190/5 "2024-02-01T15:24:22Z")
I'm not sure, how exactly I can achieve with your solution. But can you plz tell me two queries? 1. Why in kibana any visual I can't use multiple indices ? 2)Any way if I want two fields from index A and two fields from Index B and send them to Index C? ex Index A: FIELD1,FIELD2 Index B: FIELD3,FILED 4 ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [February 1, 2024, 6:19pm UTC](https://discuss.elastic.co/t/kibana-home-dashboard-showing-critical-in-red-and-non-critical-green/352190/6 "2024-02-01T18:19:42Z")
No, with Elasticsearh you can't do `join` operations easily, more details here: > **[Joining queries | Reference](https://www.elastic.co/docs/reference/query-languages/query-dsl/joining-queries)** > > Performing full SQL-style joins in a distributed system like Elasticsearch is prohibitively expensive. Instead, Elasticsearch offers two forms of join... There, though, is a new feature in tech preview to run look ups from one index into another: > **[Retrieve a runtime field | Elastic Docs](https://www.elastic.co/docs/manage-data/data-store/mapping/retrieve-runtime-field)** > > Use the fields parameter on the \_search API to retrieve the values of runtime fields. Runtime fields won’t display in \_source, but the fields API works... What I meant was to **combine** data from different sources. Let me show an example: ### Set some data Create a cople of indices with aliases and sharing a date field name ```auto PUT discuss-352190-server-logs { "aliases": { "server-logs": {} }, "mappings": { "properties": { "timestamp": { "type": "date"}, "field1": { "type": "integer"}, "field2": { "type": "keyword"} } } } PUT discuss-352190-metrics-server { "aliases": { "server-metrics": {} }, "mappings": { "properties": { "timestamp": { "type": "date"}, "field3": { "type": "integer"}, "field4": { "type": "keyword"} } } } POST discuss-352190-server-logs/_bulk { "index": {}} { "timestamp": "2023-12-01", "field1": 1, "field2": "foo"} { "index": {}} { "timestamp": "2023-12-02", "field1": 2, "field2": "foo"} { "index": {}} { "timestamp": "2023-12-02", "field1": 2, "field2": "bar"} { "index": {}} { "timestamp": "2023-12-03", "field1": 1, "field2": "bar"} { "index": {}} { "timestamp": "2023-12-03", "field1": 5, "field2": "foobar"} POST discuss-352190-metrics-server/_bulk { "index": {}} { "timestamp": "2023-12-01", "field3": 1, "field4": "foo"} { "index": {}} { "timestamp": "2023-12-01", "field3": 3, "field4": "bar"} { "index": {}} { "timestamp": "2023-12-02", "field3": 3, "field4": "bar"} { "index": {}} { "timestamp": "2023-12-02", "field3": 1, "field4": "bar"} { "index": {}} { "timestamp": "2023-12-03", "field3": 1, "field4": "bar"} ``` ## Create a data view for `server-*` See how the string `server-*` matches aliased indices using the [$ function](https://www.elastic.co/guide/en/elasticsearch/reference/current/script-fields-api.html#_convenient_simpler_access) to query the fields API ![2024-02-01_19-08](https://us1.discourse-cdn.com/elastic/original/3X/f/a/faf1db87ba96160c5f122c62180ccccdf69154e0.png) Add a runtime field that takes the value of `field1` or `field3` and exposes it as `unified_integer`: ![2024-02-01_19-08_1](https://us1.discourse-cdn.com/elastic/original/3X/3/5/35fd44d9e982513b02613d1ba8a74ae17c427fd9.png) Add also a filter to remove from the data view the original fields ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/8/68d05a65682ecef6bf5946210c48cd6acefb9e21.png) ## Explore in discover Now in Discover you get a Data View that shows only integrated data from different sources: ![2024-02-01_19-09](https://us1.discourse-cdn.com/elastic/original/3X/0/c/0cb7853261ca520d13ee3d2b41988bc965ef9f74.png) Does this help? ---
**Author:** ![PRASHANT\_MEHTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prashant_mehta/32/101764_2.png) [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Post date:** [February 5, 2024, 7:58am UTC](https://discuss.elastic.co/t/kibana-home-dashboard-showing-critical-in-red-and-non-critical-green/352190/7 "2024-02-05T07:58:40Z")
Hello @jsanz , Many thanx again to take your time for this detailed explanation ! Now I have some reference what you exactly meant. I will try this and see if I could achieve my desired result through this. This was a new learning for me . ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 4, 2024, 7:59am UTC](https://discuss.elastic.co/t/kibana-home-dashboard-showing-critical-in-red-and-non-critical-green/352190/8 "2024-03-04T07:59:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.