Questions on Graph

Elastic Stack Kibana
1

So i have three questions:

  1. I know I can share either a snapshot or a saved version of visualizations. Is there something similar for Graph so I can display it on a page outside Kibana? I saw something saying New Workspace saving and sharing on the Graph main page but can't figure out how. Or am I misunderstanding what it meant somehow.

  2. Is there a way to search the current graph and highlight/move the screen to the search term?

  3. if i have some nodes selected and select to go to the raw documents. it brings me to the Discover page with the last time filter I used. This often means that the relevent documents are out of scope of the time filter. How do I circumvent that issue.

2

You can save a workspace which will preserve the choice of index pattern, fields, colours, icons etc and also any vertices/connections currently loaded in the workspace. This is a "disconnected" view meaning that the graph may include a selection of vertices e.g. IP addresses that are no longer present in the index/indices behind the index pattern. Only when you try drill-down from these vertices will it become apparent that they no longer exist in your index. This is by design - items of interest such as rogue IPs may come and go in the underlying indices but remain an item of interest in saved workspaces.
If you open a saved workspace, the URL in the browser will change to the unique ID of that workspace and this is a URL that can be shared.

Not currently. The standard "ctrl-F" search facility of the browser can find and highlight text labels inside the SVG used to render the graph but lacks the pan/zoom required to bring them centre stage.

Kibana
Kibana1484×792 86.1 KB

When you drill-down from Graph to other parts of Kibana you can generally preserve any visualization configuration choices in that visualization because they are held in the URL. The trick is to configure the target visualization e.g. Discover with the choice of settings then copy the URL from the browser's URL input and paste that into the Graph settings - see this demo.

Another quick fix for the Discover tab specifically might be to use an index-pattern for Graph or more general use where you specifically choose in the index settings: "no, I do not want to use the time filter".

Hope this helps.

3

Mark,

Thank you for your reply!

I worked out how saving worked which is nice for internal usage but was hoping to get it on website with other data we already had for them so i was hoping for an iframe type object. Is this perhaps something that may happen in the future?

Using Ctrl-F works but was hoping for as you said something to bring it to center stage.

As for the discover page the non-timestamped index pattern may be a good answer. Additionally I watched the demo and while I had used the drill down urls for other things had never used them for kibana and the auto creation of the template was cool. Additionally that brings me to two new questions about the url drill down in particular.

  1. does the drill down url support post urls?

  2. I don't think there is but is there a way to sepearate out different selected node types to different parts of the url...someting like www.fakeurl.com/search=user={{gqueryUSERNODE}_country={{gquerryCOUNTRYNODE}}

4

For now there's a manual hack you can use - see Iframe to graph - #2 by Mark_Harwood

For fancier drill-down integrations you may need to introduce some sort of custom proxy to redirect as appropriate. The Graph URL drill-down templates can use a variety of param encodings so if you use the RISON encoded query dsl that should pass the JSON from which you can parse out field names and terms from the URL. You'd then need to redirect as appropriate to the target system using a POST or whatever URL encoding is required for the target system and the parsed terms.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.