# Visualize query with nested filter

**URL:** <https://discuss.elastic.co/t/visualize-query-with-nested-filter/170131>\
**Category:** Kibana\
**Created:** [February 27, 2019, 9:59am UTC](https://discuss.elastic.co/t/visualize-query-with-nested-filter/170131 "2019-02-27T09:59:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bene](https://avatars.discourse-cdn.com/v4/letter/b/76d3ee/32.png) [@Bene](https://discuss.elastic.co/u/Bene)\
**Post date:** [February 27, 2019, 9:59am UTC](https://discuss.elastic.co/t/visualize-query-with-nested-filter/170131/1 "2019-02-27T09:59:27Z")

</div>

Hi \*,

I have some problems visualize data in timelion with this query:

`.es(timefield=createdAt,index=test*,q="installUnique:ad822d4 AND controllerNumber:0 and channel_number.number:00",metric=max:channel_number.demand).label(demand)`

The problem is the data structure itself, I can not change this index. And I need to visualize the inner hits of the array channel\_number.demand filtered by channel\_number.number="00"

```
{
  "_index": "test",
  "_type": "ctrls",
  "_id": "5c7473a40c5bc84f",
  "_version": 2,
  "_score": 3.9815443,
  "_source": {
    "__v": 0,
    "channel_number": [
      {
        "_id": "5c7473aa5bc859",
        "act_state": false,
        "demand": 0,
        "number": "00"
      },
      {
       "_id": "5c74bc858",
        "act_state": false,
        "demand": 0,
        "number": "01"
      }
    ],
    "controllerNumber": "0",
    "createdAt": "2019-02-25T23:00:52.293Z",
    "installUnique": "768df22f25454",
  },
  "fields": {
    "createdAt": [
      "2019-02-25T23:00:52.293Z"
    ]
  }

```

How can I unmarshall the channel\_number array in order to visualize it correctly in timelion? Do I need to create an index alias or something like that?

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 27, 2019, 2:48pm UTC](https://discuss.elastic.co/t/visualize-query-with-nested-filter/170131/2 "2019-02-27T14:48:02Z")

</div>

hi @Bene

You might want to look into Kibana scripted fields [https://www.elastic.co/guide/en/kibana/current/scripted-fields.html](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html) . You can just access these in your Timelion expression like any other field.

Perhaps you could write a script that would extract the value for the right channel (?) YMMV

---

<div class="post-metadata">

**Author:** ![Bene](https://avatars.discourse-cdn.com/v4/letter/b/76d3ee/32.png) [@Bene](https://discuss.elastic.co/u/Bene)\
**Post date:** [February 27, 2019, 4:44pm UTC](https://discuss.elastic.co/t/visualize-query-with-nested-filter/170131/3 "2019-02-27T16:44:18Z")

</div>

Hi @thomasneirynck

that was my first idea, do you have any hint for me on how to do that? I have no experience with scripted fields extracting the source document...

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 27, 2019, 6:01pm UTC](https://discuss.elastic.co/t/visualize-query-with-nested-filter/170131/4 "2019-02-27T18:01:38Z")

</div>

this [https://www.elastic.co/blog/using-painless-kibana-scripted-fields](https://www.elastic.co/blog/using-painless-kibana-scripted-fields) will help to get started.

you can use the `doc` global to access the document. There's more detailed examples in that doc-post

---

<div class="post-metadata">

**Author:** ![Bene](https://avatars.discourse-cdn.com/v4/letter/b/76d3ee/32.png) [@Bene](https://discuss.elastic.co/u/Bene)\
**Post date:** [February 28, 2019, 6:47am UTC](https://discuss.elastic.co/t/visualize-query-with-nested-filter/170131/5 "2019-02-28T06:47:42Z")

</div>

I tried with scripted field, unfortunately as it is an object inside channel\_number array, I can not analyze it (because the scripted field will be string). Is there a possibility to copy the content inside the array to a whole new index and write parent \_id into it?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2019, 6:58am UTC](https://discuss.elastic.co/t/visualize-query-with-nested-filter/170131/6 "2019-03-28T06:58:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.