Kibana visualization and foreach?

[brandondash (Brandon Biondo)]

I found the foreach processor for Elasticsearch, but I am wondering if that same ability exists in the Kibana UI?

My use case is that I save a search for the creation of a meeting with a unique meetingId. Now, for each meetingId I'd like to create a visualization that presents data of the users. In the logs this is captured by a UserJoinedEvent with the meetingId and the userId.

Is this possible?

[cjcenizal]

Hi Brandon,

The foreach processor is for preprocessing documents before they're indexed in Elasticsearch, and no such functionality exists in Kibana. I'm a bit confused about what you're asking for here.

Now, for each meetingId I'd like to create a visualization that presents data of the users

It sounds like you want to dynamically generate visualizations based on the data set returned by a query. Kibana doesn't support this in the UI, but you could write some scripts or use automation tools to do this. Here's some information about the API you'll need to hit: https://github.com/elastic/kibana/pull/11632.

You can GET a visualization using this API to see what kind of payload you'd need to send to create it. For example:

curl -H "Content-Type: application/json" -H "kbn-xsrf: true" http://localhost:5601/api/saved_objects/visualization/{visualization ID}

You can find the visualization ID by opening up the visualization in Kibana and looking for the ID in the URL:

http://localhost:5601/app/kibana#/visualize/edit/{visualization ID}

Hope this helps,
CJ

[brandondash (Brandon Biondo)]

It sounds like you want to dynamically generate visualizations based on the data set returned by a query.

I am OK with the data being static by the time I want to visualize, but that would require subqueries.

Does Kibana support sql-style subqueries? My forum searches have all returned the answer "no" but that has been for Kibana 4.x and earlier.

[cjcenizal]

Sorry Brandon, Kibana doesn't support sql-style subqueries.

CJ