Visualize in Data Table

Elastic Stack Kibana
1

Hi Team,
I am trying to build an informative Data table that includes fields, arrays and objects, they are "not analyzed" for better aggregation. But when i am adding few fields, query is not returning any result and it displays "No results found".
I am using "count" as metric, didn't find anything suitable. Although, my objective is to prepare data table, i don't really need any of the metric values.

I guess the reason is, some of the fields are empty or even doesn't exists in some cases. My question is, how can we allow null values and null columns in the Data table?

Thanks & Regards

2

Hi @piyush,

Can you share the query request that Kibana is making to Elasticsearch and the response from it?

The easiest way to find the request and response would be to open the spy panel for the data table visualization you are building. To do this, click on the little ^ under the data table visualization, then click on "Request" and "Response" to see the request and response respectively. If you could paste the request and response into this post, that would help figure out what's going on.

Thanks!

Shaunak

3

Hi Shaunak,
I am not getting request/response when "no result found".

But i notice that it's a date field (create date but data type is string) for which i am getting error.

  1. if create_date is first field i am getting result.
  2. but if i add second field instance_id then it says "no result found"

( create_date and instance_id both are string)

Thanks & Regards

4

Can you share screenshots of your Visualize page showing both scenarios, 1 and 2? It might make it easier for me to understand what is going on.

5

Hi Shunak,
Before taking snapshot i tried one thing and not sure how but when i refresh index and rebuild data table (@timestamp first field, data type timestamp) it's populating desire output.

I still have one question, how can we consider "Null" values? count metric will never allow a result if any of the field is blank.

Thanks & Regards

1 Like
6

To include counts of null or missing values, add a snippet like the example shown below to the JSON input box in the "Advanced" section of the aggregation:

{ "missing": "2016-07-03" }

Screen Shot 2016-07-18 at 5.03.24 PM.png710×820 33.4 KB

This will count all null/missing values and associate them with the "2016-07-03" bucket. Obviously change that bucket to whatever makes sense for your data.

7

Thanks Shaunak, it helped.

Thanks & Regards