Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Showing Different Document Types in Kibana from ElasticSearch

I'm in the process of trying to setup a Kibana dashboard. This dashboard is hitting an ElasticSearch index. My index has the following mappings:

"myindex": {
  "mappings": {
    "animals": {
      "properties": {
        "@timestamp": {
          "type": "date",
          "format": "dateOptionalTime"
        },
        "@version": {
          "type": "string"
        },
        "Class": {
          "type": "string"
        },
        "Order": {
          "type": "string"
        },
        "Family": {
          "type": "string"
        },
        "Genus": {
          "type": "string"
        },
        "Species": {
          "type": "string"
        }
      }
    },
    "elements" : {
      "properties": {
        "@timestamp": {
          "type": "date",
          "format": "dateOptionalTime"
        },
        "@version": {
          "type": "string"
        },
        "Symbol": {
          "type": "string"
        },
        "Name": {
          "type": "string"
        },
        "Group": {
          "type": "string"
        },
        "Period": {
          "type": "string"
        }             
      }
    }
  }
}

As the mappings show, my index has two different types of information. My challenge is, I don't know how to setup my kibana dashboard to just list the information for each type. I've confirmed that the data in my elasticsearch instance is the correct data.

In my dashboard, I'm trying to show two tables. One table will show all of the documents associated with "animals". The other table will show all of the documents associated with "elements". Unfortunately, I can't figure out how to focus the results of a table down to a specific type. I'm basically trying to figure out how to setup either a query or a filter (not sure the difference between the two in the kibana world) for a specific panel. Currently, my dashboard looks like this:

{
  "title": "Research",
  "services": {
    "query": {
      "list": {
        "0": {
          "query": "*",
          "alias": "",
          "color": "#7EB26D",
          "id": 0,
          "pin": false,
          "type": "lucene"
        }
      },
      "ids": [
        0
      ]
    },
    "filter": {
      "list": {
        "0": {
          "type": "time",
          "field": "@timestamp",
          "from": "now-{{ARGS.from || '24h'}}",
          "to": "now",
          "mandate": "must",
          "active": true,
          "alias": "",
          "id": 0
        }
      },
      "ids": [
        0
      ]
    }
  },
  "rows": [
    {
      "title": "Animals",
      "height": "350px",
      "editable": true,
      "collapse": false,
      "collapsable": true,
      "panels": [
        {
          "title": "Animals",
          "error": false,
          "span": 12,
          "editable": true,
          "group": [
            "default"
          ],
          "type": "table",
          "size": 100,
          "pages": 5,
          "offset": 0,
          "sort": [
            "@timestamp",
            "desc"
          ],
          "style": {
            "font-size": "9pt"
          },
          "overflow": "min-height",
          "fields": [
            "Class",
            "Order",
            "Family",
            "Genus",
            "Species"
          ],
          "localTime": true,
          "timeField": "@timestamp",
          "highlight": [],
          "sortable": true,
          "header": true,
          "paging": true,
          "spyable": true,
          "queries": {
            "mode": "all",
            "ids": [
              0
            ]
          },
          "field_list": true,
          "status": "Stable",
          "trimFactor": 300,
          "normTimes": true
        }
      ],
      "notice": false
    },
    {
      "title": "",
      "height": "350px",
      "editable": true,
      "collapse": false,
      "collapsable": true,
      "panels": [
        {
          "title": "Elements",
          "error": false,
          "span": 12,
          "editable": true,
          "group": [
            "default"
          ],
          "type": "table",
          "size": 100,
          "pages": 5,
          "offset": 0,
          "sort": [
            "@timestamp",
            "desc"
          ],
          "style": {
            "font-size": "9pt"
          },
          "overflow": "min-height",
          "fields": [
            "Symbol",
            "Name",
            "Group",
            "Period"
          ],
          "localTime": true,
          "timeField": "@timestamp",
          "highlight": [],
          "sortable": true,
          "header": true,
          "paging": true,
          "spyable": true,
          "queries": {
            "mode": "all",
            "ids": [
              0
            ]
          },
          "field_list": true,
          "trimFactor": 300,
          "normTimes": true
        }
      ],
      "notice": false
    }    
  ],
  "editable": true,
  "failover": false,
  "index": {
    "interval": "none",
    "default": "myindex"
  },
  "style": "dark",
  "panel_hints": true,
  "pulldowns": [
    {
      "type": "query",
      "collapse": false,
      "notice": false,
      "query": "*",
      "pinned": true,
      "history": [],
      "remember": 10
    },
    {
      "type": "filtering",
      "collapse": true,
      "notice": false
    }
  ],
  "loader": {
    "save_gist": false,
    "save_elasticsearch": true,
    "save_local": true,
    "save_default": true,
    "save_temp": true,
    "save_temp_ttl_enable": true,
    "save_temp_ttl": "30d",
    "load_gist": true,
    "load_elasticsearch": true,
    "load_elasticsearch_size": 20,
    "load_local": true,
    "hide": false
  },
  "refresh": "30s"
}

Can someone tell me how to show two different types of documents in Kibana? I see a queries object on the table panel. Yet, I have no idea how to use it.

Thank you so much

like image 428
user3284007 Avatar asked Apr 15 '14 17:04

user3284007


2 Answers

You can use the _type field to narrow the result to a specific elastic search type (e.g. animals).

So when you define the query (or filter) for your table, just make sure to specify the relevant _type (i.e. _type: animals)

like image 83
Shahar Avatar answered Sep 19 '22 01:09

Shahar


You can use scripted fields to have value of type as separate field which will be indexed.

or you can add _type field to search field it will be available.

In case of scripted fields add as doc['_type'].value and give it any name you want.

https://github.com/elastic/kibana/issues/5684

like image 45
gaurhari dass Avatar answered Sep 22 '22 01:09

gaurhari dass