Trying to query elastic data and create a a variable in grafana for dashboarding, but it doesn’t populate the values in the preview section. Here is the JSON msg format in source data (Elastic v7.5):
Variable query in grafana:
{“find”: “terms”, “field”: “agent.hostname”}
No preview data comes up.
However, when I chose {“find”: “terms”, “field”: “jvm”} - I see data being previewed.
Appreciate any insights into it…
Sample source data in elastic:
{ "_index": "elastic-2020.09.30", "_type": "_doc", "_id": "O69R4HQBkDz3L01E8RLR", "_version": 1, "_score": null, "_source": { "tenurefree": 405913392, "@timestamp": "2020-09-30T18:41:39.712Z", "ecs": { "version": "1.1.0" }, "tags": [ "beats_input_codec_plain_applied" ], "jvm": "xyz", "log": { "file": { "path": "log.xml.013" }, "offset": 9884781, "flags": [ "multiline" ] }, "durationms": 13.794, "agent": { "type": "filebeat", "ephemeral_id": "a6a86b85-0ae0-441a-b85c-4aeae3ff7ccb", "hostname": "xyz", "id": "ff3ddde2-9b11-414f-a6db-a8ddd09d74f8", "version": "7.5" } }, "fields": { "@timestamp": [ "2020-09-30T18:41:39.712Z" ] }, "sort": [ 1601491299712 ] }
Source data is being ingested into elastic through a template, where the agent.hostname is being captured as a type text.
"agent.hostname" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword" } }