Kibana - Visualize - create table from search query

Hi,

I used the Dev Tools tab in Kibana to create a search query (a bit complex using 3 aggregations) and would like to use that query with the Visualize tab to create a table, is that possible ?

Thanks,
E

Hi,

It's not possible to use the search query from dev tools to create a table unfortunately. You need to query using visualizations tab. But we do have an option of using JSON input in advanced settings. Perhaps you want to give it a try?

Thanks,
Bhavya

Hi @bhavyarm,

With my query I'm using top_hits aggregation and max aggregation, any idea if it supports those? What I'm doing is the following:

  1. First using terms aggregation on Field1 (essentially grouping by Field1) then later sort by max sub-aggregator
  2. Then using top_hits sub aggregator to sort by Field2 descending and also return source fields like Field2, Field3, Field4
  3. Then using max sub-aggregator on field Field2

The result is that I get my data in buckets that are sorted by the fields I want.

Can this or something similar be accomplished with the Visualize feature ?

It seems like this would be possible to create without using the Advanced JSON field (just using the visualization selections).

Top Hits is supported in Kibana 5.2 https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-top-hits-aggregation.html

I think you should try to build your visualization using the Visualize tab.

If you can't build exactly what you want, you could save a Data Table, and then go to the Saved Objects in Management and modify the query there, but you would be on your own of that breaks. There's no guarantee the Data Table would work after you modify the query that way.

Regards,
Lee

Sorry, correction: Top Hits is in Elasticsearch 5.2, but not in Kibana until 5.3 which is not released yet. It should be released soon and I'll try to let you know when it is.

@LeeDr

Gotcha, thanks for letting me know!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.