Show all Data in saved Search on a Kibana Dashboard

Elastic Stack Kibana
1

Hi All,
Im using Kibana 7.6.1.
I need to greate a monthly report of some Audit-Data. I would like to greate a Dashboard with some visualisations and a saved search showing all "raw" Audit-Data.
Then i would use watcher to generate monthly a PDF of the Dashboard and archive the PDF (3rd Party Software).

My Problem is, i couldn't find a way to display all data in a saved search on the Dashbaord. Its limited to 50 Events. I found some older Topics discussing the same, with no solution. Is this now possible?

My only idea would be to export the search seperatly as CSV and store this beside the PDF.
Are there any other ways to do this?

Regards,
Simon

2

@KoettingSimon I'm not sure I understand what you mean by 'display all data in a saved search on the Dashboard' and it being limited to 50 Events. Do you mean that the pagination is set to 50? If so, there's a discover:sampleSize setting in Management / Advanced Settings that is adjustable.

3

Hi @cheiligers,
Thanks for your reply.

Yes, that's basically what i mean.

I also found this setting, but nothing changes. I set the discover:sampleSize to 100, later to 500 but all saved searches in a dashboard still have pagination set to 50.

image

image
image1850×236 20.4 KB

4

I tested this too and see what you mean.
For now, I guess downloading the csv is your best option. I've searched in the open Github issues but couldn't find an issue for this. There are, however, plans to migrate the Discover table and Discover saved search to use the EUIDataGrid component but there's no specific target date.

1 Like
5

Thanks for your help.
So I will start with the csv option and open a issue on GitHub for this.
Hopefully we can then use it in a later release.

6

Thank you for opening an issue! If you wouldn't mind posting a link to the issue here, it'll help others if they need to do something similar. :slightly_smiling_face:

7

Of course. Here is the link to the issue:

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.