OR filter on dashboard in Kibana 4

问题

I want to create a dashboard which shows information about a limited set of request values :

request:("/path1" OR "/path2" OR "/path3")

What I've tried so far:

I can add filters to the dashboard by clicking on a part of a pie chart, but all these filters are applied as AND filters and not OR. This way of working also requires actual data for all possible request values. Which is not always the case in a test environment.
in Discover I created a saved search but I don't know how I can apply this to my Dashboard so it gets part of the dashboard definition.

Is their a way to do this using the Dashboard editor or does it require some json scripting via Settings->Objects->Dashboards ? If so can you point me a good reference to this (escaped) syntax ?

In Kibana 3 you could define filters of type "either". Does this functionality exist in Kibana 4 ?

I'm using Kibana 4.0.2

回答1:

I am not sure if this is an answer to your actual question, I'll write it anyway as someone may benefit and I found examples on the Kibana filter syntax to be elusive when googling.

I am trying to define a boolean filter instead of a boolean query in my Discover tab, to unclutter the search field and fascilitate further filtering on a limited set of values.

I found this link to the documentation where AND, OR, NOT filter syntax is described. After a bit of experimenting this was what worked for me, example:

I have a field named host containing the name of the server shipping the log entry. There are quite a few servers, each belonging to one of several redundancy groups. To filter only for log entries produced by the servers "SERVER06 OR SERVER07 OR SERVER08" which happen to belong to a distinct redundancy group B-Servers I can make an OR filter like so:

{
  "bool": {
    "should": [
      {
        "query": {
          "match": {
            "host": {
              "query": "SERVER06",
              "type": "phrase"
            }
          }
        }
      },
      {
        "query": {
          "match": {
            "host": {
              "query": "SERVER07",
              "type": "phrase"
            }
          }
        }
      },
      {
        "query": {
          "match": {
            "host": {
              "query": "SERVER08",
              "type": "phrase"
            }
          }
        }
      }
    ]
  }
}

and save it as a search called B-Servers. Now I get a filtered list, where I can cherry pick a server with a further and more restrictive filter. Before I had all servers and the quick count only listed the five top entries, so I had to pick one and then edit the filter manually if my target wasn't in the list.

This should be useful for other string type fields too. The documentation should have included a couple of more examples I think, to set the context for the placement of the bool statement and not just a demonstration of the principle.

This link was also useful for demonstrating how to do booleans from the search field rather than as a filter.

[EDIT] An update for Kibana 5.2 as I could not get the previous syntax to work. The following did the trick with 5.2, I used this link to figure it out:

{
  "query": {
    "bool": {
      "should": [
        {
          "match": {
            "host": "SERVER06"
          }
        },
        {
          "match": {
            "host": "SERVER07"
          }
        },
        {
          "match": {
            "host": "SERVER08"
          }
        }
      ],
      "minimum_should_match": 1
    }
  }
}

回答2:

Kibana 4 is a total rewrite and apparently not all Kibana 3 features are yet implemented. I've found an "enhancement" ticket in the Kibana github: https://github.com/elastic/kibana/issues/3693

This closes my question for the moment.

回答3:

Definitely you can add OR filters in your dashboard. As dashboard is created from saved visualizations, In your visualization you can add filter containing OR which will reflect such data.

As per my understanding of your question I am posting my answer (Feel free to correct me):-

Clicking on pie chart under visualize tab (Create a new visualization).
Selecting a search source - From a new search
Go to Split Slices, select aggregation as filters. Under Query1 enter the filter you want to apply such as request:("/path1" OR "/path2") Click on add Filter and add Query2 as: request:("/path2" OR "/path3")
1. Click on Apply to view the changed pie chart as per filters.
2. Save Visualization by selecting it from toolbar (2nd option beside search bar).
3. Go to Dashboard & Click on Add Dashboard & select your saved visualization which will reflect your pie chart.

Hope it answers your question :)

回答4:

The lucene syntax is "OR" (uppercase), so "foo OR bar".

Once your query is corrected, you can save the search in the Discover tab and refer to that saved search in your Visualization.

You can also manually set the query in the visualization if you don't want the overhead of saving it separately.

来源：https://stackoverflow.com/questions/30592608/or-filter-on-dashboard-in-kibana-4

标签

kibana

kibana-4