Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Editable filters #1583

Closed
jimmyjones2 opened this issue Oct 8, 2014 · 105 comments
Closed

Editable filters #1583

jimmyjones2 opened this issue Oct 8, 2014 · 105 comments

Comments

@jimmyjones2
Copy link
Contributor

@jimmyjones2 jimmyjones2 commented Oct 8, 2014

Would be great if filters were editable in the Kibana 4 Discover page, like they were in Kibana 3. This allows you quickly add a filter for a field of interest, but change the value to one not in the current set, or something else you're interested in. I know it can be done with the query, but would be better for people scared/too lazy for that!

@rashidkpc
Copy link
Contributor

@rashidkpc rashidkpc commented Oct 8, 2014

While I agree this is a good feature, it likely won't happen for some time. There is an infrastructure that needs to be built around filters to properly facilitate the inclusion of custom filters. Long term we want to provide structured inputs for filters, shorter term we need the ability to insert JSON filters

@mkliu
Copy link

@mkliu mkliu commented Nov 14, 2014

On the same line, i could click on a pie chart and filter down to a set of data, that feature is lost in Kibana 4?

@kadaan
Copy link

@kadaan kadaan commented Jan 28, 2015

This should be available not just on Discover but also Visualize and Dashboard

@ecneladis
Copy link
Member

@ecneladis ecneladis commented Feb 5, 2015

+1

4 similar comments
@zytek
Copy link

@zytek zytek commented Feb 5, 2015

+1

@szibis
Copy link

@szibis szibis commented Feb 5, 2015

+1

@rayl
Copy link

@rayl rayl commented Feb 8, 2015

+1

@bladypirat
Copy link

@bladypirat bladypirat commented Feb 17, 2015

+1

@rashidkpc rashidkpc added the help wanted label Feb 25, 2015
@tomkregenbild
Copy link

@tomkregenbild tomkregenbild commented Mar 3, 2015

+1

@benningm
Copy link

@benningm benningm commented Mar 6, 2015

At least a button to create a filter from the current query field would be useful.

@sebdotv
Copy link

@sebdotv sebdotv commented Mar 19, 2015

+1, Kibana 4 should make it easier to work with filters because cached filters generally outperform queries [http://www.elastic.co/guide/en/elasticsearch/guide/current/_queries_and_filters.html]

@rugger74
Copy link

@rugger74 rugger74 commented Mar 24, 2015

+1. This may prevent migration to the new kibana for my company.

@siavashgh
Copy link

@siavashgh siavashgh commented Apr 13, 2015

+1

Editable filters in the former version was one of the best features. Specially because of the immediate response as @sebdotv mentioned.

xqm4n

@peterlau
Copy link

@peterlau peterlau commented Apr 17, 2015

Here's my workaround to this. Not ideal but it might satisfy some. This will allow you to add arbitrary filters to your search, not just the limited term match filters you get by clicking on fields.

  1. Under the Discover tool, customize your search to your liking, minus any custom filter(s) that you need but cannot add at this point. Save it.
  2. Click on the 'Open folder' button. Inside the dropdown, click the 'manage searches' link at the top right hand corner.
  3. Click the pen next to the search you created in step one.
  4. In the last text box (kibanaSavedObjectMeta.searchSourceJSON), scroll to the bottom and find the 'filter' array, add your custom filter to the bottom. In my example below I'm seaching for a non-null 'exception_class' field using an asterisk. This cannot typically be done using the interface.
  5. Save the search object, this takes you back to the 'manage searches' page. Click on the 'Eye' button next to your search to test it.
  6. It's important that you've made all the filters that you need in step 1 because from this point onward you won't be able to add any new filters via the UI. It'll generate a JS error. You can however enable and disable any of the existing filters, including any custom filters that you just added. The query bar should work as normal.
 "filter": [
..... existing filters .....
    {
      "meta": {
        "disabled": false,
        "index": "[logstash-]YYYY.MM.DD",
        "key": "query",
        "negate": false,
        "value": "exception.exception_class:*"
      },
      "query": {
        "query_string": {
          "analyze_wildcard": true,
          "query": "exception.exception_class:*"
        }
      }
    }
]

@roman-parkhunovskyi-sp
Copy link

@roman-parkhunovskyi-sp roman-parkhunovskyi-sp commented Apr 25, 2015

+1. the feature which forces me to keep Kibana3 still alive

@hetzge
Copy link

@hetzge hetzge commented Apr 25, 2015

+1

@roman-parkhunovskyi-sp
Copy link

@roman-parkhunovskyi-sp roman-parkhunovskyi-sp commented Apr 27, 2015

Doesn't work in Firefox 37. Related to #3610.

@thelalle
Copy link

@thelalle thelalle commented Apr 27, 2015

+1

2 similar comments
@kmartensson
Copy link

@kmartensson kmartensson commented Apr 27, 2015

+1

@hyperletter
Copy link

@hyperletter hyperletter commented Apr 27, 2015

+1

@koniin
Copy link

@koniin koniin commented Apr 27, 2015

+1 , would really improve usability!

@SecEng
Copy link

@SecEng SecEng commented Apr 27, 2015

+1

1 similar comment
@oshmyrko
Copy link

@oshmyrko oshmyrko commented Apr 28, 2015

+1

@ServerNinja
Copy link

@ServerNinja ServerNinja commented Nov 9, 2015

+1

@superpaul
Copy link

@superpaul superpaul commented Nov 11, 2015

+1
Current workaround is to use the search field and it would be really nice to have editable filters not just "enable", "remove" and "toggle"
here's what I used for workaround editable filters from search field
"field": "query message *"

@gloyka
Copy link

@gloyka gloyka commented Nov 12, 2015

+1

1 similar comment
@phss
Copy link
Contributor

@phss phss commented Nov 20, 2015

+1

@stephanmitchev
Copy link

@stephanmitchev stephanmitchev commented Nov 20, 2015

+1*10^1000
On Nov 20, 2015 6:42 AM, "Paulo Schneider" notifications@github.com wrote:

+1


Reply to this email directly or view it on GitHub
#1583 (comment).

@warpkanal
Copy link

@warpkanal warpkanal commented Nov 26, 2015

Thanks alot for that feature in K4.3, like it!!

@mspangdal
Copy link

@mspangdal mspangdal commented Dec 17, 2015

I'm using Kibana 4.3 .. how do I enable adding filters on dashboards? Theres no button to add a "blank" filter, and editing filters that appear by clicking a aggregation opens up a editable JSON.. This functionality was much better in Kibana 3, just reuse the search box?

@mckennab
Copy link

@mckennab mckennab commented Dec 17, 2015

Hey Magnus,

Welcome to Kibana 4. I +1ed above when I first upgraded to Kibana 4. I
still do think we need to correct the regression and allow editing of a
filter like we could do in Kibana 3, but in the meantime, I have figured
out how to get along.

Instead of editing the filters, you need to start using the query bar that
is located above the filters. It contains * to match everything by default.
Just type in the text that you want in the value of the Filter. The query
is case insensitive for values by default and it will find the string in
your records.
You can also just search a specific file by including the Field: in the
query, but field names ARE case sensitive. Breed: poodle

Note, Quote the string if it contains separators, the match will be an OR
on each token. black cat will locate any record that contains
black OR cat, case insensitive. "black cat" matches the full string
Separators are not just spaces. (Word Delimiter Token Filter: by default,
all non alpha-numeric characters) 127:0:0:1 is treated as 4 tokens.
If you are searching in a specific field, and you know that your value
contains separators, search on the Field.raw: Elasticsearch is so smart,
when it sees those separators in the value, it will treat the value as an
array for you and match only on the separate values in the array.

Once the records are retrieved, Expand the quick visualization on the field
that you want to filter on. Because of the query, it should list the value
you want, and you can add the filter from there.

Of course, you cannot add a filter this way, if your data does not contain
a record with a matching value, but in this case, you can see from the
query, that the value is not in your data.

Search for examples of how to use the query syntax and you should be able
to quickly locate the records you need. Using the query is a different way
of doing the same thing.

ɐuuǝʞɔɯ qoq

Bob McKenna | SaaS Operational Services (SOS)
IBM Cloud | SaaS Operational Services  IBM Software Group


Email: mckennab@us.ibm.com | officE: 720.395.4950 | mobilE: 919.749.9801

From: Magnus Spångdal notifications@github.com
To: elastic/kibana kibana@noreply.github.com
Cc: Bob McKenna/Raleigh/IBM@IBMUS
Date: 12/17/2015 03:25 AM
Subject: Re: [kibana] Editable filters (#1583)

I'm using Kibana 4.3 .. how do I enable adding filters on dashboards?
Theres no button to add a "blank" filter, and editing filters that appear
by clicking a aggregation opens up a editable JSON.. This functionality was
much better in Kibana 3, just reuse the search box?


Reply to this email directly or view it on GitHub.

@mspangdal
Copy link

@mspangdal mspangdal commented Dec 28, 2015

Throwing all filters in the search box quickly reduces the maintainability of a dashboard...
Thanks for posting the workaround though, I figured it out too after some tinkering - it is however a regression in the UX from Kibana 3! 😞

@sutyrin
Copy link

@sutyrin sutyrin commented Dec 29, 2015

+1

1 similar comment
@David-seattle
Copy link

@David-seattle David-seattle commented Jan 5, 2016

+1

@ErnestOrt
Copy link

@ErnestOrt ErnestOrt commented Jan 27, 2016

+100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

@sutyrin
Copy link

@sutyrin sutyrin commented Jan 27, 2016

@ErnestOrt, I am already using this in 4.3.1 ;)

@ErnestOrt
Copy link

@ErnestOrt ErnestOrt commented Jan 28, 2016

@SpaceDiver, but can you set filters and unable and disable like this:

image

because although it's similar than this, it's not really the same:

image

In our case it's really useful in order to track information in a user level.

Anyway, I'm going to check last version as you suggest and let's see if it's there

@ErnestOrt
Copy link

@ErnestOrt ErnestOrt commented Jan 28, 2016

@SpaceDiver, Bth, Thanks Pavel ;)

@davecampbell
Copy link

@davecampbell davecampbell commented Apr 26, 2016

+1

@GlenRSmith
Copy link
Contributor

@GlenRSmith GlenRSmith commented May 20, 2016

Should the PR pending label be removed?

@tylersmalley
Copy link
Member

@tylersmalley tylersmalley commented May 20, 2016

@GlenRSmith yeah, just removed. Thanks.

@sabw8217
Copy link

@sabw8217 sabw8217 commented May 20, 2016

+1

1 similar comment
@kirPoNik
Copy link

@kirPoNik kirPoNik commented Jun 29, 2016

+1

@glebsts
Copy link

@glebsts glebsts commented Jul 5, 2016

Damn I need it.

@gabereiser
Copy link

@gabereiser gabereiser commented Jul 20, 2016

+1

1 similar comment
@simonwheatley
Copy link

@simonwheatley simonwheatley commented Jul 28, 2016

👍

@yami12376
Copy link

@yami12376 yami12376 commented Feb 8, 2017

+1

+1 here: #5249

@andi-livn
Copy link

@andi-livn andi-livn commented Mar 1, 2017

+1

@royceking
Copy link

@royceking royceking commented May 17, 2017

+1 +1 +1 +1

@ckent1933
Copy link

@ckent1933 ckent1933 commented Oct 20, 2017

+1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests