How to list unique values of a particular field in Kibana

Question

I am having a field named rpc in my elasticsearch database and I am displaying it using Kibana. When I search in search bar of kibana like:

rpc:*

It display all the values of rpc field but I want to have only those value to be displayed which are unique.

Answer 1

I have been playing around with Kibana4 since a couple of weeks now. I find it intuitive and simple and the experience has been great till now. Following your question, I tried getting unique results via a Data Table visualization. Why? Because I personally find it easier to understand. Following are the steps:

1. Get unique count

Create the visualization (Visualize -> Data Table). First lets get the count of how many unique entries we have for a particular field (We will use this in the later part for verification). I'm using clientip.raw but as I see, it will work just fine with any friendly field name too.

2. Set the aggregation right

Set you aggregation back to count and have a Split Rows as follows. Not doing this will give you count 1 for each field value (since it is looking for unique counts) when you populate the table. Noteworthy part is setting the Top field to 0. Because Kibana won't let you enter anything else than a digit (Obviously!). This was the tricky part. Hit Apply and you'll get the results. Unique field values and the count of each of them.

3. Verification:

Going to the last page of the table, we see there are exactly 543 results. This is how I know it works.

What Next?

You save this visualization and add it to a Dashboard. There you can always check the request, query, response and other stats.

Answer 2

Just an addition to the above mathakoot answer.

For the user of newer version (which do not allow bucket size of 0 anymore) just set a value greater than the maximum number of result

And report the value in the Options>Per Page field

Answer 3

I wanted to achieve something similar but I'm stuck with Kibana 3.1.

I simply added a panel of type "TERMS" and configured its Field = User-agent and left everything else on default values. This gave me a nice bar chart with one bar for each User-agent.