Remove default filter from aggregation

Elastic Stack Kibana
1

I am trying to create a vertical bar chart with filter aggregation. I am adding JSON input instead of adding separate filters. But we need to have at least one filter there (Filter 1) even if we are providing JSON input. Issue is that in the bar chart, I get an extra bucket with "*" label which I have not added in my JSON input. I assume it comes from that default filter.
Is there any setting that I can set to disable this default filter from all visualizations?

2

I don't believe there is a way to disable this, but you are correct that it comes from the default filter.

Can you share what your JSON input is? I am not sure there is a workaround, but we can take a closer look.

3

Hi Lukas,

This is the JSON input:

{
"filters": {
"CreateOrder": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: CreateOrder"
}
}
},
"SendOrderEmail": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: SendOrderEmail"
}
}
},
"RepriceOrder": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: RepriceOrder"
}
}
},
"SubmitOrder": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: SubmitOrder"
}
}
},
"CustomerQuery": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: CustomerQuery"
}
}
},
"UserDetails": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: UserDetails"
}
}
},
"LDAP": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: LDAP"
}
}
},
"DeliveryDateQuery": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: DeliveryDateQuery"
}
}
},
"PickingParameterExport": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: PickingParameterExport"
}
}
},
"CreditCheck": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: CreditCheck"
}
}
},
"SubstituteArticles": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: SubstituteArticles"
}
}
},
"AddCatalogItem": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: AddCatalogItem"
}
}
},
"CatalogHeaderQuery": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: CatalogHeaderQuery"
}
}
},
"CatalogItemQuery": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: CatalogItemQuery"
}
}
},
"CreateCatalog": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: CreateCatalog"
}
}
},
"DeleteCatalog": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: DeleteCatalog"
}
}
},
"DeleteCatalogItems": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: DeleteCatalogItems"
}
}
},
"OrderHeaderQuery": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: OrderHeaderQuery"
}
}
},
"OrderItemQuery": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: OrderItemQuery"
}
}
},
"UpdateCatalog": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: UpdateCatalog"
}
}
},
"UpdateCatalogItems": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: UpdateCatalogItems"
}
}
},
"PriceMaster": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: PriceMaster"
}
}
},
"PricingRequest": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: PricingRequest"
}
}
},
"StockCheck": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: StockCheck"
}
}
}
}
}

4

And below is the elasticsearch request body:

{
"size": 0,
"aggs": {
"2": {
"filters": {
"filters": {
"": {
"query": {
"query_string": {
"query": "",
"analyze_wildcard": true
}
}
},
"CreateOrder": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: CreateOrder"
}
}
},
"SendOrderEmail": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: SendOrderEmail"
}
}
},
"RepriceOrder": {
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "Method: RepriceOrder"
}
}
},(REMOVED)
}
},
"aggs": {
"3": {
"avg": {
"field": "ElapsedMs"
}
}
}
}
},
"query": {
"filtered": {
"query": {
"query_string": {
"query": "logfile: "PP-OO-ResponseTimeLog"",
"analyze_wildcard": true
}
},
"filter": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"gte": 1451586600000,
"lte": 1483208999999,
"format": "epoch_millis"
}
}
}
],
"must_not": []
}
}
}
},
"highlight": {
"pre_tags": [
"@kibana-highlighted-field@"
],
"post_tags": [
"@/kibana-highlighted-field@"
],
"fields": {
"*": {}
},
"fragment_size": 2147483647
}
}

(Removed few buckets to fit in the response)
If you see in the request body, there is one extra query added for * which I guess is because of that default filter.