Put Max date filter by default in Kibana

[suhasgupta1 (SUHAS GUPTA)]

Hi All,

My question is related to

Filtering on date = max_date

Short version: How do I create a "saved search" that filters based on the most recent date available? Long version: I have a daily PIG job that updates ES based on the today's date. The problem is that sometimes the job fails and no data is updated for several days. So I want Kibana to filter based only on the data with the latest date, regardless of whether it's from today or a week ago. Is it possible and if so, how? From what I've read here, I can retrieve the max "date" value with somethin…

Is that possible today?

I want to put filter by default in Kibana dashboard which will always select max date from date field. Is it possible with Query DSL if yes kindly tell how ?

Thanks & Regards
Suhas Gupta

[tylersmalley]

I have a couple thoughts on how this could be accomplished.

Canvas pipelines support subexpressions, so you should be able to accomplish this with something like the following:

essql {string "SELECT .... WHERE timestamp <=" {esdocs <get latest document> | getCell <timestamp field>} }

The Canvas pipeline expressions are also coming to Kibana proper and will be soon the bases of all visualizations which will make things like this much easier in the future.

Another, possibly easier solution is to alter the dasboard/visualization as part of your daily job. Here is the API for the underlying data Kibana persists: https://www.elastic.co/guide/en/kibana/current/saved-objects-api.html.

[suhasgupta]

Hi Tylersmalley,

Thank you for replying, I am not pro in elasticsearch or kibana. Could you kindly tell if I can write this essql in query DSL in Filter in kibana or where can I use this query.

Thanks
Suhas

[suhasgupta1 (SUHAS GUPTA)]

Hello @tylersmalley, Kindly guide how to use this query, can I write this query in filter in DSL query section of kibana, Or I have to write this query at some other location.

Thanks & Regards
Suhas Gupta