Elasticsearch define template variable (from nested field)

Grafana Elasticsearch
1

hello, I have on ElasticSearch side the following json doc:

...
'linux': {
      'uname': 'bob'
}
...

I want to define a template variables that gather all uname values:

{"find": "terms", "field": "linux.uname"}

Noted here I use linux.uname refer to the field name, I am not sure if this causes the problem, but all it returns from preview is All, not anything specific. I tried to provide "size" option, doesn’t help either.

Am I suppose to see a list of values in preview? Do I have to actually use this variable in some panel definition to see the output?

Any help is much appreciated.

Oliver

2

Yes, you should see the actual fetched values in the preview.

The way your data is indexed in elasticsearch makes a difference on how you can query it.
The elasticsearch default for a string would be a textfield + a keyword field.
For more info on the difference between text and keyword:

For your grafana usecase, this will probably work:

{"find":"terms","field":"linux.uname.keyword"}
1 Like
3

that seems to be the exact problem - I wasn’t quite aware the difference; Not to excuse myself the ignorance, Grafana’s doc should really note this as this seems to be the common case. thanks again.