Question about filtering in a visualisation in Kibana

Hi,

New to Elastic/Kibana and have got a simple question about filtering in a visualisation in Kibana. I have some data stored in a rollup index, and when I visualise it, the y-axis displays 'count', and the buckets are: X-axis-@timestamp per 30 days, split series: Company.keyword: Descending, split series: IdNo.keyword: descending.

What I want to do is be able to filter these results so that I can see each company separately. I.e., in this data, say filtering so that it just shows members of the 'purple' category (and modifying the y-axis scale accordingly). This would leave three bars on the histogram and a shorter y-axis scale. Alternately filtering out all but the pink members would leave one bar and an even smaller y-axis. How can I do this?

Adding the filter 'Company.keyword is Purple' does not work. Any help appreciated. Thanks!

Hi, is the series splitting by "Significant Terms" or "Terms"? Could you add a bit more detail about the configuration, eg. screenshot?

Hi, I believe it is being split by 'Terms' as I haven't seen 'Significant Terms' anywhere on the UI yet.

This is thrown when I try to do the visualisation:

'Rollup search error: [illegal_argument_exception] Unsupported Query in search request: [match_phrase]'

Attempting the same filter on the same index under the 'Discover' tab in Kibana returns no results, I fixed this by adding a filter and clicking 'Edit Query DSL' and changing the filter DSL from:
image
to
image

This returns the right data in Discover (because in the JSON, the key is actually "Company.keyword.terms.value" not "Company.keyword"), but this filter DSL does not work in Visualise.

Found a couple threads that may or may not be relevant:

The documentation suggests that 'If you attempt to use an unsupported query, or the query references a field that wasn’t configured in the rollup job, an exception will be thrown': https://www.elastic.co/guide/en/elasticsearch/reference/current/rollup-search-limitations.html#_limited_querying_components

However to me this doesn't seem to explain the current issue as I'm pretty sure Company.keyword is a Term defined in the rollup job, and the documentation also states that Term Queries and Terms Queries are currently valid.

Here's a more up-to-date screenshot of the histogram + its current config:

image

image

Let me know if you need any more detail, thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.