Question about filtering in a visualisation in Kibana

[blansdown]

Hi,

New to Elastic/Kibana and have got a simple question about filtering in a visualisation in Kibana. I have some data stored in a rollup index, and when I visualise it, the y-axis displays 'count', and the buckets are: X-axis-@timestamp per 30 days, split series: Company.keyword: Descending, split series: IdNo.keyword: descending.

What I want to do is be able to filter these results so that I can see each company separately. I.e., in this data, say filtering so that it just shows members of the 'purple' category (and modifying the y-axis scale accordingly). This would leave three bars on the histogram and a shorter y-axis scale. Alternately filtering out all but the pink members would leave one bar and an even smaller y-axis. How can I do this?

Adding the filter 'Company.keyword is Purple' does not work. Any help appreciated. Thanks!

[monfera (Robert Monfera)]

Hi, is the series splitting by "Significant Terms" or "Terms"? Could you add a bit more detail about the configuration, eg. screenshot?

[blansdown]

Hi, I believe it is being split by 'Terms' as I haven't seen 'Significant Terms' anywhere on the UI yet.

This is thrown when I try to do the visualisation:

'Rollup search error: [illegal_argument_exception] Unsupported Query in search request: [match_phrase]'

Attempting the same filter on the same index under the 'Discover' tab in Kibana returns no results, I fixed this by adding a filter and clicking 'Edit Query DSL' and changing the filter DSL from:

to

This returns the right data in Discover (because in the JSON, the key is actually "Company.keyword.terms.value" not "Company.keyword"), but this filter DSL does not work in Visualise.

Found a couple threads that may or may not be relevant:

Performing Terms Queries on Rolled-Up Data using Kibana

Hi, I've been trying out X-Pack Rollup (in 6.7) and cannot use Kibana to perform any terms queries for exact matches on terms that I configured Rollup for. I'm not sure whether I've done something wrong or it's just not supported or not supported yet. Is there a way to use either the Kibana search bar or the little filter panes to filter rolled-up data using terms groups that were configured in the rollup job? Below is just more elaboration in case the question is not clear. I am able to run…

Improved filter experience for rollup visualizations

The documentation suggests that 'If you attempt to use an unsupported query, or the query references a field that wasn’t configured in the rollup job, an exception will be thrown': Rollup search limitations | Elasticsearch Guide [8.11] | Elastic

However to me this doesn't seem to explain the current issue as I'm pretty sure Company.keyword is a Term defined in the rollup job, and the documentation also states that Term Queries and Terms Queries are currently valid.

Here's a more up-to-date screenshot of the histogram + its current config:

Let me know if you need any more detail, thanks