Grafana Variables Query using ElasticSearch - Filter doesn't work

Grafana Elasticsearch
1

am currently using Grafana v9.1.7 and ElasticSearch 8.4.2

What I’m trying to achieve is to create a dashboard that can filter the data by country. I have a keyword field named honeypot_country (it’s a string that mapped into keyword in elastic). When this filter is selected, it should only provide set of data filtered by that country

image
image1117×705 103 KB

image
image705×714 30.8 KB

I already tried to create a variable query to filter these data. But it doesn’t filter as I want to. So, I hope anyone can help me with this issue. Thanks

2

Welcome

Please share es query that uses that variable

3

This is the JSON configuration when I press “Query Inspector”

"targets": [
    {
      "alias": "",
      "bucketAggs": [
        {
          "field": "fields.analyzer_id.keyword",
          "id": "2",
          "settings": {
            "min_doc_count": "1",
            "order": "desc",
            "orderBy": "_count",
            "size": "0"
          },
          "type": "terms"
        },
        {
          "field": "time",
          "id": "3",
          "settings": {
            "interval": "auto",
            "min_doc_count": "0",
            "timeZone": "utc",
            "trimEdges": "0"
          },
          "type": "date_histogram"
        }
      ],
      "datasource": {
        "type": "elasticsearch",
        "uid": "1d8b2X44k"
      },
      "metrics": [
        {
          "id": "1",
          "type": "count"
        }
      ],
      "query": "",
      "refId": "A",
      "timeField": "time"
    }
  ]

And this is how I do the query using ElasticSearch. I didn’t write custom any lucene query for most of the visualization

image
image1080×771 60.9 KB

4

You would need a where clause that uses the country variable otherwise grafana cant automagically use that filter

5

Hi @yosiasz , can you help me providing an example?

6

check this out

7

Hello! Thank you for the link that you provided. Unfortunately, adding the query makes the data doesn’t appear properly. I would like to filter by country and sometimes see the data without the filter. Is it possible?

image
image1074×761 40.8 KB

8

you are comparing the variable against itself ? I Think you need

{ honeypot_country: $honeypot_country }
9

Works like a charm! Thank you very much for your help! :blush:

1 Like