Unable to load data from Kibana/elasticsearch into Vizualisation

[tsunwang89]

Hi there, I wasn't able to load data from Kibana/Elasticsearch into the 'Visualize' section for my use to plot graphics. https://vega.github.io/vega/docs/data/ also did not sepcify how i can load data that is already ingested in Kibana/Elasticsearch.

Comments in code suggests: "An object instead of a string for the "url" param is treated as an Elasticsearch query. Anything inside this object is not part of the Vega language, but only understood by Kibana and Elasticsearch server." Does this mean I need to use Elasticsearch DSL query to import the already ingested data in Kibana into 'Visualize' section? instead of URL

My API query is already working for the below:
GET sessions2-120316/_search
{ "size":100, "_source": ["protocol", "ipProtocol", "srcIp", "dstIp", "firstPacket", "lastPacket","totBytes","totDataBytes"]}

Please kindly assist!
Thanks,
Xavier

[spalger (Spencer Alger)]

The "data.url" in vega visualizations is an Elasticsearch query. It doesn't exactly ingest the data into Visualize, but it does pull data out of Elasticsearch temporarily for displaying in your visualization. Based on your console snippet it looks like your vega visualization should include the following:

{
  data: {
    url: {
      index: sessions2-120316
      body: {
        size: 100
        _source: [
          protocol
          ipProtocol
          srcIp
          dstIp
          firstPacket
          lastPacket
          totBytes
          totDataBytes
        ]
      }
    }
    ...

You can tweak your query from there, but I hope that makes it a little clearer how you specify the Elasticsearch query you want to visualize in the vega visualization.

What type of visualization are you trying to make? Keep in mind that the Vega vis is a very advanced visualization type, I have been working on Kibana for years and I barely understand how to make a useful visualization in it