Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Kibana and fixed time spans

Is it possible to set a fixed timespan for a saved visualization or a saved search in Kibana 4?

Scenario: I want to create one dashboard with 2 visualizations with different time spans.

  1. A metric counting unique users within 10 min (last 10 minutes)
  2. A metric counting todays unique users (from 00.00am until now)

Note that changing the time span on the dashboard does not affect the visualizations. Possible?

like image 317
jaspernygaard Avatar asked Feb 25 '15 11:02

jaspernygaard


People also ask

Is Kibana real time?

With Kibana, you can quickly create and share dynamic dashboards that display changes to Elasticsearch queries in real-time.

What is the difference between elastic and Kibana?

Elasticsearch is a search and analytics engine. Logstash is a server‑side data processing pipeline that ingests data from multiple sources simultaneously, transforms it, and then sends it to a "stash" like Elasticsearch. Kibana lets users visualize data with charts and graphs in Elasticsearch.

What is the difference between Kibana and Grafana?

Kibana is useful to convert log data from the ELK stack into visualizations and it also supports querying logs. Grafana is more of a general-purpose visualization tool that can work with a handful of data sets that may or may not be “logs”. But it does not support text querying.


1 Answers

You could add a date range query to the saved search you base each visualisation on. Eg, if your timestamp field is called timestamp:

timestamp:[now-6M/M TO now]

where the time range is from 'now' to '6 months ago, rounding to the start of the month.

Because Kibana also now supports JSON-based query DSL, you could also achieve the same thing by entering this into the search box instead:

{
    "range" : {
         "timestamp" : {
             "gte": "now-6M/M",
             "lte": "now" 
         }
     }
 }

For more on date range queries see https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates

However changing the dashboard timescale will override this if it's a subset. So if you use the above 6 month range in the saved search, but a 3 month range in the dashboard, you'll filter to 3 months of data.

like image 135
Henry S Avatar answered Sep 23 '22 02:09

Henry S