Storing a value before filterrows and accessing it after

Elastic Stack Kibana
1

I have a situation where I want to filter rows out, but I want to save the number of pre-filtered rows into variable to use later in the variable expression editor (specifically to calculate a percentage value with the pre- and post-filtered values)

How do I accomplish this? I attemped to store the value in a variable via var_set, but apparently var_set doesn't do what I expected because it nullified all my table data when I tried to set it.

| esdocs index="phil.test" fields="fileInspected.filename, fileInspected.fileInfo.fileAttributes"
| var name="totalfiles"
| var_set name="totalfiles" value="size(fileInspected.filename)"
| filterrows {getCell "fileInspected.fileInfo.fileAttributes" | eq "FILE_ATTRIBUTE_ARCHIVE"}
| math "size(fileInspected.filename)/totalfiles"

The above doesn't work... depending on how I write this either the variable is not recognized in the math function... or my entire table is removed and replaced.

Is it possible to store a value in the expression editor?

2

The createTable example in the Canvas function reference shows how var_set can be used to achieve a goal like this.

Rather than using the esdocs function and using filterrows to isolate the non-applicable data, have you thought of using essql to get the total number of docments, and to select the applicable documents in a query?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.