CODEWITHSUNDEEP
elasticsearchkibanakibana-5
Andrei T.
Andrei T.

Reputation: 2480

Is there a way to define a dynamic query in Kibana dashboard?

A somewhat similar question has been asked here but there's no answer for that yet. That question relates to an older version of Kibana so I hope you can help me.

I'm trying to setup some predefined queries in the Kibana dashboard. I'm using Kibana 5.1. The purpose of those queries is filtering some logs based on multiple different parameters.

Let's see a query I'd like to execute:

{
  "index": "${index_name}",
  "query": {
    "query_string": {
      "query": "message:(+\"${LOG_LEVEL}\")",
      "analyze_wildcard": true
    }
  }
}

I know I can query directly in the dashboard something like "message:(+"ERROR")" and manually change the ERROR to WARN for example, but I don't want that - imagine that this query might be more complex and contain multiple fields.

Note that the data stored in the message is not structured - think of the message as a whole log line. This means I don't have fields like LOG_LEVEL which I could filter directly.

Is there any way I can set the index_name and LOG_LEVEL dynamically from the Kibana Discover dashboard?

Upvotes: 4

Views: 2820

Answers (1)

Pigueiras
Pigueiras

Reputation: 19356

You should go to discover, open one document and click over this buttonMirroring glass in any of the fields. After this, a filter will appear under the search bar and you can edit it and put any custom query. If you want add more filters with more custom queries you can repeat the same action with a different document or field or you can do to Settings (or Management), Saved Objects, go to the Search you saved and to the JSON representation and copy and paste the elements inside the filter array field as many times you want.

And remember that in order to apply one of the filters, you probably should disable the enabled ones (otherwise it will filter by all the enabled filters in your dashboard).

Upvotes: 1

Related Questions