# Suspected bug with Panel.parameters.length when there # samples than length
**URL:** https://discuss.elastic.co/t/suspected-bug-with-panel-parameters-length-when-there-samples-than-length/18650
**Category:** Elasticsearch
**Created:** [July 14, 2014, 3:01pm UTC](https://discuss.elastic.co/t/suspected-bug-with-panel-parameters-length-when-there-samples-than-length/18650 "2014-07-14T15:01:04Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Danny\_Lieberman](https://discuss.elastic.co/u/Danny_Lieberman)
#### Post date: [July 14, 2014, 3:01pm UTC](https://discuss.elastic.co/t/suspected-bug-with-panel-parameters-length-when-there-samples-than-length/18650/1 "2014-07-14T15:01:04Z")
I'm using ES and Kibana to collect security events and visualize them using
an Items panel. For the sake of illustration a security event has a
site and subject and other attributes.
My expectation was that if you specify panel.parameters.length = 10 (for
example) and a panel.parameters.order = count, you will get the top 10 with
all events totaled (like an SQL SELECT count(\*), site FROM index GROUP by
site)
In practice it seems like Kibana is issuing a query like this below - which
pulls 10 records (like SQL limit 10) in panel.item field - so if you have
25 events of a particular site - you will only get the first 10.
{
"query": { "match\_all": {} },
"size": 10
}'
So - to make a long story short - how do take _all the records in the index_
and limit the panel to _show only the top 10?_
You will excuse me if this is a newbie question.
Thanks
Danny
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/fc5f8b20-50f8-4b88-81ef-4371eb49e9bc%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/fc5f8b20-50f8-4b88-81ef-4371eb49e9bc%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Itamar\_Syn\_Hershko](https://discuss.elastic.co/u/Itamar_Syn_Hershko)
#### Post date: [July 14, 2014, 3:12pm UTC](https://discuss.elastic.co/t/suspected-bug-with-panel-parameters-length-when-there-samples-than-length/18650/2 "2014-07-14T15:12:33Z")
You don't
You either pull a small page of data to display (match\_all query or any
filtering query), or ask ES to aggregate the data for you and get back the
metrics or buckets. You can also do both at the same time.
--
Itamar Syn-Hershko
[http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)
Freelance Developer & Consultant
Author of RavenDB in Action [http://manning.com/synhershko/](http://manning.com/synhershko/)
On Mon, Jul 14, 2014 at 6:01 PM, Danny Lieberman [dl@software.co.il](mailto:dl@software.co.il) wrote:
> I'm using ES and Kibana to collect security events and visualize them
> using an Items panel. For the sake of illustration a security event has
> a site and subject and other attributes.
>
> My expectation was that if you specify panel.parameters.length = 10 (for
> example) and a panel.parameters.order = count, you will get the top 10 with
> all events totaled (like an SQL SELECT count(\*), site FROM index GROUP by
> site)
>
> In practice it seems like Kibana is issuing a query like this below -
> which pulls 10 records (like SQL limit 10) in panel.item field - so if you
> have 25 events of a particular site - you will only get the first 10.
> {
> "query": { "match\_all": {} },
> "size": 10
> }'
>
> So - to make a long story short - how do take _all the records in the
> index_ and limit the panel to _show only the top 10?_
>
> You will excuse me if this is a newbie question.
>
> Thanks
> Danny
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/fc5f8b20-50f8-4b88-81ef-4371eb49e9bc%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/fc5f8b20-50f8-4b88-81ef-4371eb49e9bc%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/fc5f8b20-50f8-4b88-81ef-4371eb49e9bc%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/fc5f8b20-50f8-4b88-81ef-4371eb49e9bc%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsfbwiad5h1j%3DsoSvekv%2B4Z-GGjQ4R8eqLDH\_k6z0hcVg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsfbwiad5h1j%3DsoSvekv%2B4Z-GGjQ4R8eqLDH_k6z0hcVg%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Danny\_Lieberman](https://discuss.elastic.co/u/Danny_Lieberman)
#### Post date: [July 14, 2014, 3:22pm UTC](https://discuss.elastic.co/t/suspected-bug-with-panel-parameters-length-when-there-samples-than-length/18650/3 "2014-07-14T15:22:27Z")
Thanks - suspected bug in my thinking.
D
On Monday, July 14, 2014 6:01:04 PM UTC+3, Danny Lieberman wrote:
> I'm using ES and Kibana to collect security events and visualize them
> using an Items panel. For the sake of illustration a security event has
> a site and subject and other attributes.
>
> My expectation was that if you specify panel.parameters.length = 10 (for
> example) and a panel.parameters.order = count, you will get the top 10 with
> all events totaled (like an SQL SELECT count(\*), site FROM index GROUP by
> site)
>
> In practice it seems like Kibana is issuing a query like this below -
> which pulls 10 records (like SQL limit 10) in panel.item field - so if you
> have 25 events of a particular site - you will only get the first 10.
> {
> "query": { "match\_all": {} },
> "size": 10
> }'
>
> So - to make a long story short - how do take _all the records in the
> index_ and limit the panel to _show only the top 10?_
>
> You will excuse me if this is a newbie question.
>
> Thanks
> Danny
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/1c176765-38a1-4ec8-a4c1-2300deef9d77%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1c176765-38a1-4ec8-a4c1-2300deef9d77%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Danny\_Lieberman](https://discuss.elastic.co/u/Danny_Lieberman)
#### Post date: [July 14, 2014, 3:27pm UTC](https://discuss.elastic.co/t/suspected-bug-with-panel-parameters-length-when-there-samples-than-length/18650/4 "2014-07-14T15:27:08Z")
Itamar,
So I assume then that I need to customize the facet filter query using
aggregations
> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.
Don't see any way to do this out of the box in Kibana GUI fwiw....
Thanks
Danny
On Monday, July 14, 2014 6:01:04 PM UTC+3, Danny Lieberman wrote:
> I'm using ES and Kibana to collect security events and visualize them
> using an Items panel. For the sake of illustration a security event has
> a site and subject and other attributes.
>
> My expectation was that if you specify panel.parameters.length = 10 (for
> example) and a panel.parameters.order = count, you will get the top 10 with
> all events totaled (like an SQL SELECT count(\*), site FROM index GROUP by
> site)
>
> In practice it seems like Kibana is issuing a query like this below -
> which pulls 10 records (like SQL limit 10) in panel.item field - so if you
> have 25 events of a particular site - you will only get the first 10.
> {
> "query": { "match\_all": {} },
> "size": 10
> }'
>
> So - to make a long story short - how do take _all the records in the
> index_ and limit the panel to _show only the top 10?_
>
> You will excuse me if this is a newbie question.
>
> Thanks
> Danny
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/39c25dbe-5a66-4e84-8468-003694c71c90%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/39c25dbe-5a66-4e84-8468-003694c71c90%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:16am UTC](https://discuss.elastic.co/t/suspected-bug-with-panel-parameters-length-when-there-samples-than-length/18650/5 "2017-07-06T01:16:02Z")