Unrecognized function: kibanaRemoveFilter

Hello,

I get a visualisation error in Kibana:
Unrecognized function: kibanaRemoveFilter

The Vega code for the visualisation is below. It worked before we upgraded Kibana to OpenSearch 2.2.1

Would anyone know why is that ?

{
  "$schema": "https://vega.github.io/schema/vega/v5.json",
  "description": "Treemap.",
  "padding": 30,
  
  "config": {
    "kibana": {
      "hideWarnings": true // avoid showing warnings, e.g. when there is no data 
    }
  }

  "signals": [
    {
      "name": "aspectRatio", "value": 1.6,
      "bind": {"input": "range", "min": 1, "max": 5, "step": 0.1}
    },
    {
      // reserve some place for the "Back" button
      "name": "tree_height",
      "update": "height-10"
    },
    {
      // get the name of the shortest path from "shortest_path" data
      "name": "parentpath",
      "update": '''
      isDefined(data('shortest_path')[0]) ?
      data('shortest_path')[0].argmin_length._source.path : ''
      '''
    },
    {
      // get the day of the last timestamp
      "name": "last_day",
      "update": '''
      isDefined(data('last_timestamp')[0]) ?
      dayofyear(data('last_timestamp')[0].max_date) : -1
      '''
    },
    {
      // check if parent path is a leaf
      "name": "is_leaf",
      "update": '''
      isDefined(data('shortest_path')[0]) ?
      data('shortest_path')[0].argmin_length._source.leaf : 'no'
      '''
    },
    {
      // toggle scale
      "name": "logarithmic",
      "value": false,
      "on": [
        {
          "events": "@toggle:click",
          "update": "!logarithmic"
        }
      ]
    }
    {
      // change the filter after one of the rectangles was clicked
      "name": "add_filter",
      "on": [
        {
          "events": "@nodes:click",
          "update": '''
          kibanaRemoveFilter(
          {
            "wildcard": {
              "path": datum._source.parentpath+"*"
            }
          }, 'eosmon_resmon_*')+
          kibanaAddFilter(
          {
            "wildcard": {
              "path": datum._source.path+"*"
            }
          }, 'eosmon_resmon_*')
          '''
        }
      ]
    },
    {
      // change the filters after the "Back" button was clicked
      "name": "go_back",
      "on": [
        {
          "events": "@button:click",
          "update": '''
          parentpath != '/eos/' ?
          (is_leaf == 'no' ?
          kibanaRemoveFilter(
          {
            "wildcard": {
              "path": datum._source.parentpath+"*"
            }
          }, 'eosmon_resmon_*')+
          kibanaAddFilter(
          {
            "wildcard": {
              "path": datum._source.grandparentpath+"*"
            }
          }, 'eosmon_resmon_*')
          : kibanaRemoveFilter(
          {
            "wildcard": {
              "path": datum._source.path+"*"
            }
          }, 'eosmon_resmon_*')+
          kibanaAddFilter(
          {
            "wildcard": {
              "path": datum._source.parentpath+"*"
            }
          }, 'eosmon_resmon_*'))
          : 0
          '''
        }
      ]
    }
  ],

  "data": [
    {
      // get the documents from ElasticSearch index
      "name": "docs",
      "url": {
        %context%: true
        %timefield%: timestamp
        index: eosmon_resmon_tree-*
        body: {
          size: 10000
        },
      },
      format: { property: "hits.hits" },
      "transform": [
        {"type": "formula", "as": "date", "expr": "timeParse(datum._source.timestamp , '%Y-%m-%dT%H:%M:%SZ')"}
      ]
    },
    {
      // find the shortest path - it is the parent path of the current level
      "name": "shortest_path",
      "source": "docs",
      "transform": [
        {"type": "formula", "as": "length", "expr": "length(datum._source.path)"},
        {"type": "aggregate", "fields": ["length"], "ops": ["argmin"]}
      ]
    },
    {
      // find the last timestamp
      "name": "last_timestamp",
      "source": "docs",
      "transform": [
        {"type": "aggregate", "fields": ["date"], "ops": ["max"]}
      ]
    },
    {
      // get the documents that should be displayed on the current level and
      // transform them into a tree
      "name": "tree",
      "source": "docs",
      "transform": [
        {"type": "filter", "expr": "is_leaf == 'no' ? datum._source.parentpath == parentpath : true"},
        {"type": "filter", "expr": "dayofyear(datum.date) == last_day"},
        {"type": "fold", "fields": ["_source.maxspace"], "as":["key", "maxspace"]}, // get maxspace field to the top level. Treemap tranform can't see the nested fields after the nest transform.
        {"type": "formula", "as": "size", "expr": "logarithmic && datum.maxspace > 0 ? log(datum.maxspace) : datum.maxspace"},
        {
          "type": "nest",
          "keys": ["_source.path"]
        },
        {
          "type": "treemap",
          "field": "size",
          "round": true,
          "sort": {"field": "value", "order": "descending"},
          "method": "resquarify",
          "ratio": {"signal": "aspectRatio"},
          "size": [{"signal": "width"}, {"signal": "tree_height"}],
          "padding": 1
        }
      ]
    },
    {
      // get the documents that should be displayed
      "name": "leaves",
      "source": "tree",
      "transform": [{ "type": "filter", "expr": "!datum.children" }]
    },
    {
      // get an example document
      "name": "sample",
      "source": "leaves",
      "transform": [{ "type": "sample", "size": 1 }]
    }
  ],

  "scales": [ 
    {
      "name": "opacity",
      "type": "pow",
      "exponent": 0.3,
      "domain": {"data": "leaves", "field": "maxspace"},
      "range": [0.1, 1.0]
    },
    {
      "name": "size",
      "type": "linear",
      "domain": [0, {"signal": "width"}],
      "range": [3, 100]
    }
  ],
  
  "marks": [
    {
      "name": "button"
      "type": "rect",
      "from": {"data": "sample"}, // signal update needs to get the parentpath
      "encode": {
        "enter": {
          "fill": {"value": "white"}
          "stroke": {"value": "black"}
        },
        "update": {
          "x": {"value": 4},
          "y": {"signal": "tree_height+10"},
          "width": {"value": 60},
          "height": {"value": 30},
        }
      }
    },
    {
      "type": "text",
      "interactive": false,
      "from": {"data": "sample"}, // don't show the text if there is no data
      "encode": {
        "enter": {
          "align": {"value": "center"},
          "baseline": {"value": "middle"},
          "text": {"value": "Back"},
          "fontSize": {"value": 17},
        },
        "update": {
          "x": {"signal": "34"},
          "y": {"signal": "tree_height+26"}
        }
      }
    },
    {
      "name": "toggle"
      "type": "rect",
      "from": {"data": "sample"}, // signal update needs to get the parentpath
      "encode": {
        "enter": {
          "fill": {"value": "white"}
          "stroke": {"value": "black"}
        },
        "update": {
          "x": {"signal": "width-120"},
          "y": {"signal": "tree_height+10"},
          "width": {"value": 120},
          "height": {"value": 30},
        }
      }
    },
    {
      "type": "text",
      "interactive": false,
      "from": {"data": "sample"}, // don't show the text if there is no data
      "encode": {
        "enter": {
          "align": {"value": "center"},
          "baseline": {"value": "middle"},
          "text": {"value": "Toggle scale"},
          "fontSize": {"value": 17},
        },
        "update": {
          "x": {"signal": "width-60"},
          "y": {"signal": "tree_height+26"}
        }
      }
    },
    { 
      "name": "nodes"
      "type": "rect",
      "from": {"data": "leaves"},
      "encode": {
        "enter": {
          "fill": {"value": "orange"}
          "fillOpacity": {"scale": "opacity", "field": "maxspace"}
          "tooltip": {"signal": "datum._source.path+' ('+datum._source.usedspacestring+' / '+datum._source.maxspacestring+')'"}
        },
        "update": {
          "x": {"field": "x0"},
          "y": {"field": "y0"},
          "x2": {"field": "x1"},
          "y2": {"field": "y1"},
        }
      }
    },
    {
      "type": "text",
      "from": {"data": "leaves"},
      "interactive": false,
      "encode": {
        "enter": {
          "align": {"value": "center"}, 
          "baseline": {"value": "middle"},
        },
        "update": {
          "x": {"signal": "0.5 * (datum.x0 + datum.x1)"},
          "y": {"signal": "0.5 * (datum.y0 + datum.y1)"},
          "fontSize": {"scale": "size", "signal": "0.85*(datum.x1-datum.x0)"},
          // show dirname only if font size is readable
          "text": {"signal": "scale('size', 0.85*(datum.x1-datum.x0)) > 8 ? datum._source.dirname : ''"}
        }
      }
    },
    {
      "type": "text",
      "interactive": false,
      "encode": {
        "enter": {
          "align": {"value": "left"},
          "baseline": {"value": "middle"},
          "text": {"signal": '''
          isDefined(data('sample')[0]) ? '' : 
          ['No Data. Note to specific queries: ',
          ' ',
          'filtering specific ranges of quota parameters (usedlogicalbytes, usedfiles, maxlogicalbytes, etc.)',
          'or excluding specific values of string fields "NOT <id / id_type / statusbytes>: <value>"',
          ' ',
          'need to have the index specified explicitly to keep tree visualisation functional, e.g.:',
          ' ',
          '"NOT id_type:daemon" --> ',
          '"(_index:eosmon_resmon_quota* AND NOT id_type:project) OR _index:eosmon_resmon_tree*"'
          ]
          '''}
          "fontSize": {"value": 20},
        },
        "update": {
          "x": {"signal": "50"},
          "y": {"signal": "50"}
        }
      }
    }
  ]
}

OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

If you are using the aws fork of Kibana you will need to ask them sorry.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.