Question about filtering in a visualisation in Kibana


New to Elastic/Kibana and have got a simple question about filtering in a visualisation in Kibana. I have some data stored in a rollup index, and when I visualise it, the y-axis displays 'count', and the buckets are: X-axis-@timestamp per 30 days, split series: Company.keyword: Descending, split series: IdNo.keyword: descending.

What I want to do is be able to filter these results so that I can see each company separately. I.e., in this data, say filtering so that it just shows members of the 'purple' category (and modifying the y-axis scale accordingly). This would leave three bars on the histogram and a shorter y-axis scale. Alternately filtering out all but the pink members would leave one bar and an even smaller y-axis. How can I do this?

Adding the filter 'Company.keyword is Purple' does not work. Any help appreciated. Thanks!

Hi, is the series splitting by "Significant Terms" or "Terms"? Could you add a bit more detail about the configuration, eg. screenshot?

Hi, I believe it is being split by 'Terms' as I haven't seen 'Significant Terms' anywhere on the UI yet.

This is thrown when I try to do the visualisation:

'Rollup search error: [illegal_argument_exception] Unsupported Query in search request: [match_phrase]'

Attempting the same filter on the same index under the 'Discover' tab in Kibana returns no results, I fixed this by adding a filter and clicking 'Edit Query DSL' and changing the filter DSL from:

This returns the right data in Discover (because in the JSON, the key is actually "Company.keyword.terms.value" not "Company.keyword"), but this filter DSL does not work in Visualise.

Found a couple threads that may or may not be relevant:

The documentation suggests that 'If you attempt to use an unsupported query, or the query references a field that wasn’t configured in the rollup job, an exception will be thrown': Rollup search limitations | Elasticsearch Guide [7.15] | Elastic

However to me this doesn't seem to explain the current issue as I'm pretty sure Company.keyword is a Term defined in the rollup job, and the documentation also states that Term Queries and Terms Queries are currently valid.

Here's a more up-to-date screenshot of the histogram + its current config:



Let me know if you need any more detail, thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.