Visualize all the dates a keyword field changes

Elastic Stack Kibana
1

I have a serie of documents like this:

timestamp CAR.keyword ENGINE_SERIAL_NUMBER.keyword
20-02-2017 CAR1 A0001
20-02-2017 CAR2 B0001
21-02-2017 CAR1 A0001
21-02-2017 CAR2 B0001
22-02-2017 CAR1 A0001
22-02-2017 CAR2 B0002
23-02-2017 CAR1 A0001
23-02-2017 CAR2 B0002
24-02-2017 CAR1 A0002
24-02-2017 CAR2 B0002

As you can see,

  1. the 22nd, the ENGINE_SERIAL_NUMBER of CAR2 has changed.
  2. the 24th, the ENGINE_SERIAL_NUMBER of CAR1 has changed.

I'd like to visualize those changes. Something like:

22-02-2017 CAR2 replaced engine B0001 by B0002
24-02-2017 CAR1 replaced engine A0001 by A0002

Is it possible? I assume it could be a table view?

2

hi @dao,

This is not possible in Kibana right now.

You may want to ask this question first in the Elasticsearch forum, to see if Elasticsearch actually supports such a query to begin with (I don't think it does, but I may be wrong).

3

OK, I have created a new issue in elastic topic: Query the list of changes for a keyword field

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.