{"id":9159,"date":"2022-07-15T11:23:54","date_gmt":"2022-07-15T16:23:54","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=9159"},"modified":"2022-07-15T11:26:18","modified_gmt":"2022-07-15T16:26:18","slug":"kibana-vega-chart-with-query","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=9159","title":{"rendered":"Kibana Vega Chart with Query"},"content":{"rendered":"\n

I have finally managed to produce a chart that includes a query — I don’t want to have to walk all of the help desk users through setting up the query, although I figured having the ability to select your own time range would be useful. <\/p>\n\n\n

\n{\n  $schema: https:\/\/vega.github.io\/schema\/vega-lite\/v2.json\n  title: User Logon Count\n\n  \/\/ Define the data source\n  data: {\n    url: {\n      \/\/ Which index to search\n      index: firewall_logs*\n\n      body: {\n        _source: ['@timestamp', 'user', 'action']\n\n"query": {\n\t"bool": {\n\t\t"must": [{\n\t\t\t\t"query_string": {\n\t\t\t\t\t"default_field": "subtype",\n\t\t\t\t\t"query": "user"\n\t\t\t\t}\n\t\t\t},\n\t   {\n\t\t\t\t"range": {\n\t\t\t\t\t"@timestamp": {\n\t\t\t\t\t\t"%timefilter%": true\n                    \t\t\t}\n                  \t\t}\n     \t}]\n\t}\n}\n\n        \n        aggs: {\n          time_buckets: {\n            date_histogram: {\n              field: @timestamp\n              interval: {%autointerval%: true}\n              extended_bounds: {\n                \/\/ Use the current time range's start and end\n                min: {%timefilter%: "min"}\n                max: {%timefilter%: "max"}\n              }\n              \/\/ Use this for linear (e.g. line, area) graphs.  Without it, empty buckets will not show up\n              min_doc_count: 0\n            }\n          }\n        }\n        size: 0\n      }\n    }\n    format: {property: "aggregations.time_buckets.buckets"}\n  }\n  mark: point\n  encoding: {\n    x: {\n      field: key\n      type: temporal\n      axis: {title: false} \/\/ Don't add title to x-axis\n    }\n    y: {\n      field: doc_count\n      type: quantitative\n      axis: {title: "Document count"}\n    }\n  }\n}\n\n<\/pre><\/div>\n\n\n
\"\"<\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"
I have finally managed to produce a chart that includes a query — I don’t want to have to walk all of the help desk users through setting up the query, although I figured having the ability to select your own time range would be useful.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1588],"tags":[931,1590,1591,1669,1673],"class_list":["post-9159","post","type-post","status-publish","format-standard","hentry","category-elk","tag-data-visualization","tag-elasticsearch","tag-kibana","tag-vega","tag-vega-lite"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9159"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9159\/revisions"}],"predecessor-version":[{"id":9161,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9159\/revisions\/9161"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9159"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}