Kibana Visualization Field Formatting and Ordering

Elastic Stack Kibana
1

So i have 2 Requirements:-

  1. There is a date histogram with monthly interval and on X-Axis, i am getting intervals like :- 2017-02-01, 2017-03-01 but i want them to be February 2017, March 2017. Any idea? If i am to develop that functionality myself, what methodology would you suggest?

  2. There is a visualization (Vertical Bar/Histogram) where i am having a Terms aggregation on a weekday.keyword field and i wish to Order it by actual Day of week sequence (Eg. :- Sunday, Monday, Tuesday....). I cannot order be date as a single weekday would comprise data from multiple dates.

2

Hi @varundbest,

here would be the solutions I propose:

  1. Add ["P1MT", "MMMM YYYY"] between the entries for P1DT and P1YT to the list in the advanced setting dateFormat:scaled to define a custom formatting of monthly intervals.
  2. Instead of doing a Terms aggregation you could define a Filters aggregation and define the categories yourself, e.g. weekday.keyword:Sunday for the first Filter, weekday.keyword:Monday for the second and so on. That way you have full control over the ordering.
3

@weltenwort
In 2, the filters are getting ordered in alphabetical order of the Label. How shall i change that?
They are supposed to be returned in the order i request the filters but it's not happening this way.
Request :-

"2": {
  "filters": {
    "filters": {
      "Sunday": {
        "query_string": {
          "query": "weekday.keyword:Sunday",
          "analyze_wildcard": true
        }
      },
      "Monday": {
        "query_string": {
          "query": "weekday.keyword:Monday",
          "analyze_wildcard": true
        }
      },
      "Tuesday": {
        "query_string": {
          "query": "weekday.keyword:Tuesday",
          "analyze_wildcard": true
        }
      },
      "Wednesday": {
        "query_string": {
          "query": "weekday.keyword:Wednesday",
          "analyze_wildcard": true
        }
      },
      "Thursday": {
        "query_string": {
          "query": "weekday.keyword:Thursday",
          "analyze_wildcard": true
        }
      },
      "Friday": {
        "query_string": {
          "query": "weekday.keyword:Friday",
          "analyze_wildcard": true
        }
      },
      "Saturday": {
        "query_string": {
          "query": "weekday.keyword:Saturday",
          "analyze_wildcard": true
        }
      }
    }
  },

Response :-

  "aggregations": {
    "2": {
      "buckets": {
        "Friday": {
          "doc_count": 1848
        },
        "Monday": {
          "doc_count": 2432
        },
        "Saturday": {
          "doc_count": 2537
        },
        "Sunday": {
          "doc_count": 1802
        },
        "Thursday": {
          "doc_count": 1667
        },
        "Tuesday": {
          "doc_count": 2398
        },
        "Wednesday": {
          "doc_count": 1539
        }
      }
    }
4

You are correct, this is a known issue: https://github.com/elastic/kibana/issues/10543 Since 5.0 the Elasticsearch api does not preserve the order. I am sorry I missed that. Please feel free to add your voice to the issue linked above to give it more weight.

5

For now adding a prefix (e.g. 1 Monday, 2 Tuesday, ...) to the custom label is the only workaround I can think of.