Using collapse DSL queries in Kibana?

Elastic Stack Kibana
1

I have a DSL query that I wrote in Dev Console and I'm trying to use it in Kibana to filter down results to show in a pie chart. However, when I add the following script as a filter in Kibana, it removes the collapse portion of the query which is the most important part. What am I doing wrong? How do I get this complex collapse logic into a Kibana graph?

I am running Kibana in Elastic Cloud (v8.6.2).

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "message": "Survey response"
          }
        },
        {
          "exists": {
            "field": "labels.userId"
          }
        }
      ]
    }
  },
  "collapse": {
    "field": "labels.userId.keyword",
    "inner_hits": {
      "name": "labels.passed",
      "size": 1,
      "sort": [
        {
          "@timestamp": "desc"
        }
      ]
    }
  }
}
2

I'm pretty sure what I'm trying to do is impossible which is annoying and I hope they eventually make it possible to do DSL in Kibana. But for now I used a Transform to create a new index that only stores the most recent record and I'm building the graph from that.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.