Switch dashboard between last value (single value) and time range (aggregrated values)?

I'm creating visualizations in Kibana based on existing visualizations in a proprietary app. (I won't mention that app by name.)

That app offers the user several choices for the time span of a viz—at display time, without editing the viz—including:

  • Real time (corresponds, more or less, to latest/last value in Kibana)
  • Last n units of time (aggregated values, similar to Kibana)
  • Custom start and end time (again, aggregated, also similar to Kibana)

By contrast, in Kibana, there's no way to dynamically switch a visualization—at display time, without editing the viz—between "real time" (based on a single value) and a span that involves aggregated values. That's a decision that needs to be made when creating or editing a viz.

I'd like to be able to switch an entire Kibana dashboard of visualizations between "last value" and some other time span. Superficially, I'd like to see a "Last value" option in the dashboard time picker that would apply to all panels in the dashboard. But I understand that the implementation is not this simple.

Currently, in Kibana, I need to define different sets of visualizations: one for "last value", one for aggregated values.

Not all index patterns in the dashboards I'm working with necessarily receive new data at the same rate. If I set a dashboard to "Last 15 minutes", that might work to capture the last 1 or 2 values for data in some index patterns, but might exclude data from other index patterns that do not receive data as frequently.

Thoughts, feedback welcome.

This would definitely be a nice feature - it seems like it's a specific case of the broader area of variables/templates, tracked here: Variables for Dashboards and Embeddables · Issue #81349 · elastic/kibana · GitHub

We are thinking about this feature, but it's not on the immediate roadmap.

For now I think the best way to build something like this is to automate the generation of dashboards/visualizations using scripts and the saved object API.

You can link up dashboards using the markdown visualization to create the user experience you mention - being able to change the "mode" of the dashboard with a single click.

Thanks for the reply.

Yes, I agree. I script the generation of objects via APIs in contexts outside of Elastic, so I understand what you mean, and I might get there; however, for now, I need to set that aside as a future project. While I'm sure that investing time in doing that would reap benefits, I need to demonstrate new dashboards now.

Yes, that's a pragmatic tip, thanks. Two dashboards, with similar-but-different visualizations, except: one set shows "latest values", the other shows values aggregated over the time span.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.