Limit number of slices in pie chart

[kasun (Kasun Tharaka)]

I have created a pie chart and split the slices using filter aggregation. There are over 5 filters but I want to display only the top 5 values in the pie chart.

I can do this if I use the terms as the aggregation. But it doesn't work in my case since there are multiple keywords i want to count as one slice

[flash1293 (Joe Reuter)]

I'm not sure what exactly your problem is - could you post of screenshot of your current configuration and explain what you would like to see? In general when using the filters aggregation, you can easily control the number of slices because you have to define each one individually.

If there are multiple values which should go in a single slice you can use this kind of query for a single filter input: myField:termA OR myField:termB OR myField:termC and you will get a single slice representing all documents where myField matches either termA, termB or termC

[kasun (Kasun Tharaka)]

Thank you very much for the reply.

as in the screenshot now I have six slices for the six filters I have added, I want to display only the top 5 values in the pie chart.

I can't use aggregation by terms because as in filter one sometimes I want count multiple terms for one slice.

Is it possible to achieve this on a bar chart if it is not possible for pie charts, In bar charts I can order bars by the count in descending order. So there I only need to keep only the first five bars.

I noticed that in first screen shot filter one is not visible. So I will add this screenshot too.

[flash1293 (Joe Reuter)]

Got it, thanks for the explanation.

There is no direct way to do this as you can't order or cap filters, but I can think of a workaround:

• In index pattern management, create a scripted string field that calculates the individual categories (basically recreating the filters as painless script):

if (/* filter 1 condition*/) { return "Leave"; }
if (/* filter 2 condition*/) { return "Time"; }
if (/* filter 3 condition*/) { return "Admin"; }
..

• In your visualization, use a terms aggregation on top of the scripted field (leveraging sorting and size parameters)

[kasun (Kasun Tharaka)]

Yes, I can try that.

I read that scripted fields can demand lots of resources. In my example there are only six filters so in the script there will be only six if conditions. But in real case there will be over 60 filters. So will there be a significant performance downgrade?

[flash1293 (Joe Reuter)]

In terms aggregations specifically scripts should be fine - however if you still run into performance issues you can always move the calculation of the label into the ingest phase - for example using Logstash or an Elasticsearch ingest pipeline using the filter processor.

The downside here is you would have to re-ingest all your data if the script changes later on.