I'm trying to understand what's involved in obtaining the "Quick Counts" in kibana for a given "selected field". For example, my "message" field nominally represents logged errors, and the "Quick Counts" is more or less a representation of the most common errors.
I'd like to export a snapshot of this for inclusion in a different automated report.
"Quick Count" is just based on the first 500 records returned in the Discover tab. It's meant to give you a preview of the types of values in each field based on a small portion of the total data set.
If you'd like to see and export the most common errors, I'd recommend using Data Table in Visualize and running a Terms aggregation on the whole data set (or the portion you're interested in). There, you can also modify how many top N to return (default is 5). After that, you can export that table to CSV right from Visualize.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.
