Pinned Filters Not Working In Visualizations

Elastic Stack Kibana
1

I created a filter and pinned it but it's not taking effect in my visualization.

My filter looks like this:

{
  "query": {
    "bool": {
      "should": [
        {
          "exists": {
            "field": "field1"
          }
        },
        {
          "exists": {
            "field": "field2"
          }
        }
      ]
    }
  }
}

It works in my Discover tab but when I head over and use the same filter for my visualization, it's not working anymore.

I also tried doing it as a saved search and linking that to a visualization but it also doesn't work.

Am I missing something here?

I would appreciate any advice.

Edit: I'm running version 5.3.2

2

Is the pinned filter getting applied to the visualization? In the lower left corner of the visualization, click the toggle spy panel button. Look at the request for the visualization. Do you see your filter in the request?

1 Like
3

I think I get it now why it's not working and thank you for letting me know about the spy panel button, it led me to the right direction.

In my old filter, the request looked like this:

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "analyze_wildcard": true,
            "query": "*"
          }
        },
        {
          "bool": {
            "should": [
              {
                "exists": {
                  "field": "field1"
                }
              },
              {
                "exists": {
                  "field": "field2"
                }
              }
            ]
          }
        },
        ...
        ...

So it made another level of bool inside the bool hash.

What I did instead was created two separate filters:

{
  "exists": {
    "field": "field1"
  }
}

and

{
  "exists": {
    "field": "field2"
  }
}

pinned them and they work in my visualization. The request also looks correct now:

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "analyze_wildcard": true,
            "query": "*"
          }
        },
        {
          "$state": {
            "store": "globalState"
          },
          "exists": {
            "field": "field1"
          }
        },
        {
          "$state": {
            "store": "globalState"
          },
          "exists": {
            "field": "field2"
          }
        },
        ...
        ...

So it was a bit weird because the old filter works on discover but I guess it just works differently when applied to a visualization.

Thank you, Nathan!

4

Glad to hear that you got everything to work.

The spy panel is my favorite part of kibana. It strips away all of the magic and lets you see whats really going on ... that kibana is just a slick GUI layer and all of the power comes from Elasticsearch's amazing REST API.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.