Use Elastic GET script output in Lens (or TSVB) panel

[ivh (Ian Van Hoven)]

Hello! Tried solving this via an Elastic Support case, got nowhere ... hoping the community can help.

I have a working GET script that successfully retrieves a single document (from an entire index) that contains the max value of a numeric field (in this case, a daily closing price for a mutual fund). See script and response below.

Now I want to plot that value (50.86) as a static horizontal line in a Lens panel (or in TSVB) -- such that the value never changes, regardless of the time range selected by the user.

Can anyone show me how to use the Lens UI to accomplish this based on my (working) script? I assume I should use a "formula" -- but I can't find any posts, videos, screengrabs, etc. anywhere that depict how.

Thanks!

[ snip ]

Particulars...

• Index: wxmd
• X-Axis/Time Field: last_update
• Field: price_close
• Term: symbol (target value: dodfx)

Script...

GET /wxmd/_search?pretty
{
    "query": { "bool": { "filter": [ { "term": { "symbol": "dodfx" } } ] } },
    "size": 0,
    "aggs":{ "max_price_close": { "top_hits": { "sort": [ { "price_close": { "order": "desc" } } ], "size": 1 } } }
}

Response...

{
    "took": 1,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 1080,
            "relation": "eq"
        },
        "max_score": null,
        "hits": []
    },
    "aggregations": {
        "max_price_close": {
            "hits": {
                "total": {
                    "value": 1080,
                    "relation": "eq"
                },
                "max_score": null,
                "hits": [
                    {
                        "_index": "wxmd",
                        "_type": "_doc",
                        "_id": "VGJc8nkBH0ZppaLYUYbw",
                        "_score": null,
                        "_source": {
                            "price_close": "50.86",
                            "volume": "0",
                            "last_update": "2021-06-08 13:00",
                            "symbol": "DODFX"
                        },
                        "sort": [
                            50.86
                        ]
                    }
                ]
            }
        }
    }
}

[BenB196]

I'm going to give you only a partial answer as I'm not too familiar with the subject.

1. I don't think this is possible to do in either Lens or TSVB, I think in both cases, they limit annotations based on queries to exists fields and time ranges.
2. You might be able to do this via the Vega visualization.
   • This is where I can't provide much help, but Vega does allow you to add annotations via queries; Mean overlay over precipitation chart | Vega-Lite. Given that the Vega visualization has much more flexibility you might be able to achieve your desired outcome here.
   • Download Kibana visualization examples at elastic content share has some good examples of using the Vega visualization which might help get you started in this direction.

[Marco_Liberati]

Hi @ivh

have you checked Reference Lines in Lens?
You can do your chart, then add a new layer of type Reference line and add one static or computed line:

[ivh (Ian Van Hoven)]

Thanks @BenB196 -- appreciate the quick reply & the tip. Will LYK if that does it.

[ivh (Ian Van Hoven)]

I have used reference line w/ static value -- see attached.

It's the "computed" option I'm struggling with

[Marco_Liberati]

Why not using a Last value as in my screenshot for the reference line?