Query elasticearch from kibana visualization

[bouboune]

Hello,

1 - Is there a way to query elasticsearch instead of aggregation from a visualization?

2 - Is it possible to get the input of the search bar and query elasticsearch with it ?

3 - How can i perform query with dynamic fields ?

[LeeDr (Lee Drengenberg)]

Hi bouboune,

In this gif I query for "warning" and after it completes I collapse the histogram and that shows the Request button. If you click that you can see and copy the request. Then you can go to the Dev Tools > Console and put GET _search and paste that query body and execute it.

I'm not sure what you mean by dynamic fields. Do you mean scripted fields?

Regards,
Lee

[bouboune]

Hi,

Sorry my questions was unclear, i reformulate my question.
Can you nest queries, so the output of one query is the input to another query.
i.e in SQL:

SELECT * FROM logs WHERE logs.UserId = (SELECT UserId FROM logs WHERE logs.guid ='AERGFCVeaTLKNeFge')

The logs.guid in the second SELECT is the "dynamic field", in other word querys with parameters.

[LeeDr (Lee Drengenberg)]

OK, now I understand. No, Kibana can't do that. You would have to write an Elasticsearch client application to do that in 2 steps.

If you search for more information, you should search for subquery, and not nested query. In Elasticsearch terms they consider a nested query one where you are searching for nested objects in docs, not searching based on the results of another search.

Here's another example of your question; https://stackoverflow.com/questions/28734436/what-is-the-elasticsearch-equivalent-for-an-sql-subquery

Regards,
Lee