# Unrecognized function: kibanaRemoveFilter

**URL:** <https://discuss.elastic.co/t/unrecognized-function-kibanaremovefilter/321274>\
**Category:** Kibana\
**Tags:** vega\
**Created:** [December 15, 2022, 8:39am UTC](https://discuss.elastic.co/t/unrecognized-function-kibanaremovefilter/321274 "2022-12-15T08:39:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jaro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaro/32/100356_2.png) [@Jaro](https://discuss.elastic.co/u/Jaro)\
**Post date:** [December 15, 2022, 8:39am UTC](https://discuss.elastic.co/t/unrecognized-function-kibanaremovefilter/321274/1 "2022-12-15T08:39:28Z")

</div>

Hello,

I get a visualisation error in Kibana:  
Unrecognized function: kibanaRemoveFilter

The Vega code for the visualisation is below. It worked before we upgraded Kibana to OpenSearch 2.2.1

> **[OpenSearch Project](https://github.com/opensearch-project)**
>
> OpenSearch is a community-driven, Apache 2.0-licensed open source search and analytics suite that makes it easy to ingest, search, visualize, and analyze data. - OpenSearch Project

Would anyone know why is that ?

```auto
{
  "$schema": "https://vega.github.io/schema/vega/v5.json",
  "description": "Treemap.",
  "padding": 30,
  
  "config": {
    "kibana": {
      "hideWarnings": true // avoid showing warnings, e.g. when there is no data 
    }
  }

  "signals": [
    {
      "name": "aspectRatio", "value": 1.6,
      "bind": {"input": "range", "min": 1, "max": 5, "step": 0.1}
    },
    {
      // reserve some place for the "Back" button
      "name": "tree_height",
      "update": "height-10"
    },
    {
      // get the name of the shortest path from "shortest_path" data
      "name": "parentpath",
      "update": '''
      isDefined(data('shortest_path')[0]) ?
      data('shortest_path')[0].argmin_length._source.path : ''
      '''
    },
    {
      // get the day of the last timestamp
      "name": "last_day",
      "update": '''
      isDefined(data('last_timestamp')[0]) ?
      dayofyear(data('last_timestamp')[0].max_date) : -1
      '''
    },
    {
      // check if parent path is a leaf
      "name": "is_leaf",
      "update": '''
      isDefined(data('shortest_path')[0]) ?
      data('shortest_path')[0].argmin_length._source.leaf : 'no'
      '''
    },
    {
      // toggle scale
      "name": "logarithmic",
      "value": false,
      "on": [
        {
          "events": "@toggle:click",
          "update": "!logarithmic"
        }
      ]
    }
    {
      // change the filter after one of the rectangles was clicked
      "name": "add_filter",
      "on": [
        {
          "events": "@nodes:click",
          "update": '''
          kibanaRemoveFilter(
          {
            "wildcard": {
              "path": datum._source.parentpath+"*"
            }
          }, 'eosmon_resmon_*')+
          kibanaAddFilter(
          {
            "wildcard": {
              "path": datum._source.path+"*"
            }
          }, 'eosmon_resmon_*')
          '''
        }
      ]
    },
    {
      // change the filters after the "Back" button was clicked
      "name": "go_back",
      "on": [
        {
          "events": "@button:click",
          "update": '''
          parentpath != '/eos/' ?
          (is_leaf == 'no' ?
          kibanaRemoveFilter(
          {
            "wildcard": {
              "path": datum._source.parentpath+"*"
            }
          }, 'eosmon_resmon_*')+
          kibanaAddFilter(
          {
            "wildcard": {
              "path": datum._source.grandparentpath+"*"
            }
          }, 'eosmon_resmon_*')
          : kibanaRemoveFilter(
          {
            "wildcard": {
              "path": datum._source.path+"*"
            }
          }, 'eosmon_resmon_*')+
          kibanaAddFilter(
          {
            "wildcard": {
              "path": datum._source.parentpath+"*"
            }
          }, 'eosmon_resmon_*'))
          : 0
          '''
        }
      ]
    }
  ],

  "data": [
    {
      // get the documents from ElasticSearch index
      "name": "docs",
      "url": {
        %context%: true
        %timefield%: timestamp
        index: eosmon_resmon_tree-*
        body: {
          size: 10000
        },
      },
      format: { property: "hits.hits" },
      "transform": [
        {"type": "formula", "as": "date", "expr": "timeParse(datum._source.timestamp , '%Y-%m-%dT%H:%M:%SZ')"}
      ]
    },
    {
      // find the shortest path - it is the parent path of the current level
      "name": "shortest_path",
      "source": "docs",
      "transform": [
        {"type": "formula", "as": "length", "expr": "length(datum._source.path)"},
        {"type": "aggregate", "fields": ["length"], "ops": ["argmin"]}
      ]
    },
    {
      // find the last timestamp
      "name": "last_timestamp",
      "source": "docs",
      "transform": [
        {"type": "aggregate", "fields": ["date"], "ops": ["max"]}
      ]
    },
    {
      // get the documents that should be displayed on the current level and
      // transform them into a tree
      "name": "tree",
      "source": "docs",
      "transform": [
        {"type": "filter", "expr": "is_leaf == 'no' ? datum._source.parentpath == parentpath : true"},
        {"type": "filter", "expr": "dayofyear(datum.date) == last_day"},
        {"type": "fold", "fields": ["_source.maxspace"], "as":["key", "maxspace"]}, // get maxspace field to the top level. Treemap tranform can't see the nested fields after the nest transform.
        {"type": "formula", "as": "size", "expr": "logarithmic && datum.maxspace > 0 ? log(datum.maxspace) : datum.maxspace"},
        {
          "type": "nest",
          "keys": ["_source.path"]
        },
        {
          "type": "treemap",
          "field": "size",
          "round": true,
          "sort": {"field": "value", "order": "descending"},
          "method": "resquarify",
          "ratio": {"signal": "aspectRatio"},
          "size": [{"signal": "width"}, {"signal": "tree_height"}],
          "padding": 1
        }
      ]
    },
    {
      // get the documents that should be displayed
      "name": "leaves",
      "source": "tree",
      "transform": [{ "type": "filter", "expr": "!datum.children" }]
    },
    {
      // get an example document
      "name": "sample",
      "source": "leaves",
      "transform": [{ "type": "sample", "size": 1 }]
    }
  ],

  "scales": [ 
    {
      "name": "opacity",
      "type": "pow",
      "exponent": 0.3,
      "domain": {"data": "leaves", "field": "maxspace"},
      "range": [0.1, 1.0]
    },
    {
      "name": "size",
      "type": "linear",
      "domain": [0, {"signal": "width"}],
      "range": [3, 100]
    }
  ],
  
  "marks": [
    {
      "name": "button"
      "type": "rect",
      "from": {"data": "sample"}, // signal update needs to get the parentpath
      "encode": {
        "enter": {
          "fill": {"value": "white"}
          "stroke": {"value": "black"}
        },
        "update": {
          "x": {"value": 4},
          "y": {"signal": "tree_height+10"},
          "width": {"value": 60},
          "height": {"value": 30},
        }
      }
    },
    {
      "type": "text",
      "interactive": false,
      "from": {"data": "sample"}, // don't show the text if there is no data
      "encode": {
        "enter": {
          "align": {"value": "center"},
          "baseline": {"value": "middle"},
          "text": {"value": "Back"},
          "fontSize": {"value": 17},
        },
        "update": {
          "x": {"signal": "34"},
          "y": {"signal": "tree_height+26"}
        }
      }
    },
    {
      "name": "toggle"
      "type": "rect",
      "from": {"data": "sample"}, // signal update needs to get the parentpath
      "encode": {
        "enter": {
          "fill": {"value": "white"}
          "stroke": {"value": "black"}
        },
        "update": {
          "x": {"signal": "width-120"},
          "y": {"signal": "tree_height+10"},
          "width": {"value": 120},
          "height": {"value": 30},
        }
      }
    },
    {
      "type": "text",
      "interactive": false,
      "from": {"data": "sample"}, // don't show the text if there is no data
      "encode": {
        "enter": {
          "align": {"value": "center"},
          "baseline": {"value": "middle"},
          "text": {"value": "Toggle scale"},
          "fontSize": {"value": 17},
        },
        "update": {
          "x": {"signal": "width-60"},
          "y": {"signal": "tree_height+26"}
        }
      }
    },
    { 
      "name": "nodes"
      "type": "rect",
      "from": {"data": "leaves"},
      "encode": {
        "enter": {
          "fill": {"value": "orange"}
          "fillOpacity": {"scale": "opacity", "field": "maxspace"}
          "tooltip": {"signal": "datum._source.path+' ('+datum._source.usedspacestring+' / '+datum._source.maxspacestring+')'"}
        },
        "update": {
          "x": {"field": "x0"},
          "y": {"field": "y0"},
          "x2": {"field": "x1"},
          "y2": {"field": "y1"},
        }
      }
    },
    {
      "type": "text",
      "from": {"data": "leaves"},
      "interactive": false,
      "encode": {
        "enter": {
          "align": {"value": "center"}, 
          "baseline": {"value": "middle"},
        },
        "update": {
          "x": {"signal": "0.5 * (datum.x0 + datum.x1)"},
          "y": {"signal": "0.5 * (datum.y0 + datum.y1)"},
          "fontSize": {"scale": "size", "signal": "0.85*(datum.x1-datum.x0)"},
          // show dirname only if font size is readable
          "text": {"signal": "scale('size', 0.85*(datum.x1-datum.x0)) > 8 ? datum._source.dirname : ''"}
        }
      }
    },
    {
      "type": "text",
      "interactive": false,
      "encode": {
        "enter": {
          "align": {"value": "left"},
          "baseline": {"value": "middle"},
          "text": {"signal": '''
          isDefined(data('sample')[0]) ? '' : 
          ['No Data. Note to specific queries: ',
          ' ',
          'filtering specific ranges of quota parameters (usedlogicalbytes, usedfiles, maxlogicalbytes, etc.)',
          'or excluding specific values of string fields "NOT <id / id_type / statusbytes>: <value>"',
          ' ',
          'need to have the index specified explicitly to keep tree visualisation functional, e.g.:',
          ' ',
          '"NOT id_type:daemon" --> ',
          '"(_index:eosmon_resmon_quota* AND NOT id_type:project) OR _index:eosmon_resmon_tree*"'
          ]
          '''}
          "fontSize": {"value": 20},
        },
        "update": {
          "x": {"signal": "50"},
          "y": {"signal": "50"}
        }
      }
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2022, 8:39am UTC](https://discuss.elastic.co/t/unrecognized-function-kibanaremovefilter/321274/2 "2022-12-15T08:39:29Z")

</div>

OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 15, 2022, 8:56am UTC](https://discuss.elastic.co/t/unrecognized-function-kibanaremovefilter/321274/3 "2022-12-15T08:56:01Z")

</div>

If you are using the aws fork of Kibana you will need to ask them sorry.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 12, 2023, 8:56am UTC](https://discuss.elastic.co/t/unrecognized-function-kibanaremovefilter/321274/4 "2023-01-12T08:56:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.