Switch dashboard between last value (single value) and time range (aggregrated values)?

Elastic Stack Kibana
1

I'm creating visualizations in Kibana based on existing visualizations in a proprietary app. (I won't mention that app by name.)

That app offers the user several choices for the time span of a viz—at display time, without editing the viz—including:

  • Real time (corresponds, more or less, to latest/last value in Kibana)
  • Last n units of time (aggregated values, similar to Kibana)
  • Custom start and end time (again, aggregated, also similar to Kibana)

By contrast, in Kibana, there's no way to dynamically switch a visualization—at display time, without editing the viz—between "real time" (based on a single value) and a span that involves aggregated values. That's a decision that needs to be made when creating or editing a viz.

I'd like to be able to switch an entire Kibana dashboard of visualizations between "last value" and some other time span. Superficially, I'd like to see a "Last value" option in the dashboard time picker that would apply to all panels in the dashboard. But I understand that the implementation is not this simple.

Currently, in Kibana, I need to define different sets of visualizations: one for "last value", one for aggregated values.

Not all index patterns in the dashboards I'm working with necessarily receive new data at the same rate. If I set a dashboard to "Last 15 minutes", that might work to capture the last 1 or 2 values for data in some index patterns, but might exclude data from other index patterns that do not receive data as frequently.

Thoughts, feedback welcome.

2

This would definitely be a nice feature - it seems like it's a specific case of the broader area of variables/templates, tracked here: Variables for Dashboards and Embeddables · Issue #81349 · elastic/kibana · GitHub

We are thinking about this feature, but it's not on the immediate roadmap.

For now I think the best way to build something like this is to automate the generation of dashboards/visualizations using scripts and the saved object API.

You can link up dashboards using the markdown visualization to create the user experience you mention - being able to change the "mode" of the dashboard with a single click.

3

Thanks for the reply.

Yes, I agree. I script the generation of objects via APIs in contexts outside of Elastic, so I understand what you mean, and I might get there; however, for now, I need to set that aside as a future project. While I'm sure that investing time in doing that would reap benefits, I need to demonstrate new dashboards now.

Yes, that's a pragmatic tip, thanks. Two dashboards, with similar-but-different visualizations, except: one set shows "latest values", the other shows values aggregated over the time span.