I'm creating visualizations in Kibana based on existing visualizations in a proprietary app. (I won't mention that app by name.)
That app offers the user several choices for the time span of a viz—at display time, without editing the viz—including:
- Real time (corresponds, more or less, to latest/last value in Kibana)
- Last n units of time (aggregated values, similar to Kibana)
- Custom start and end time (again, aggregated, also similar to Kibana)
By contrast, in Kibana, there's no way to dynamically switch a visualization—at display time, without editing the viz—between "real time" (based on a single value) and a span that involves aggregated values. That's a decision that needs to be made when creating or editing a viz.
I'd like to be able to switch an entire Kibana dashboard of visualizations between "last value" and some other time span. Superficially, I'd like to see a "Last value" option in the dashboard time picker that would apply to all panels in the dashboard. But I understand that the implementation is not this simple.
Currently, in Kibana, I need to define different sets of visualizations: one for "last value", one for aggregated values.
Not all index patterns in the dashboards I'm working with necessarily receive new data at the same rate. If I set a dashboard to "Last 15 minutes", that might work to capture the last 1 or 2 values for data in some index patterns, but might exclude data from other index patterns that do not receive data as frequently.
Thoughts, feedback welcome.