kibana
kibana copied to clipboard
elastic
Nested field support
This is sort of a duplicate of some other issues I searched for but I haven't seen this particular aspect discussed, so I thought this was worth a separate issue.
You read the _mapping field, so you should know when a particular field is nested, so can it not automatically apply the correct nested facet/query when such a field is selected in queries or facets?
(Alternatively/in addition as suggested by #532, you could have a checkbox to allow users to select it themselves, perhaps as an interim measure)
I'm sure there are some cases where this gets complicated, but there are also a bunch of cases where it's a straightforward changing of one block of JSON to another.
Latest update: https://github.com/elastic/kibana/issues/1084#issuecomment-585178079
to be clear, there is no way to do a nested filter/query/agg in kibana 4 right now, is there?
+1 Because denormalizing nested objects is not always an option as this may lead to a mapping explosion.
Mapping:
{
"timestamp":{ "type":"date"},
"cluster_id": { "type":"string"},
"pools":{
"type":"nested",
"properties":{
"size":{
"type":"long"
},
"name":{
"type":"string",
"index":"not_analyzed"
}
}
}
}
First of all I would like to the line chart to be able to show the average size over time for each pool name. Assuming that there are that many names so that denormalizing is not a good idea, this might lead to many graphs in the chart. In order to work with such cases it would also be beneficial to be able to use the filter agregation inside a nested aggregation. Being able to filter on nested fields in the top search would also be great.
To make things even more interresting it would be really great to be able to visualize an aggregation like this:
"aggs": {
"poolagg": {
"nested": {
"path": "pools"
},
"aggs": {
"old": {
"filter": {
"term": {
"name": "some pool name"
}
},
"aggs": {
"avg_size": {
"avg": {
"field": "size"
}
},
"distribution": {
"histogram": {
"field": "size",
"interval": 5
},
"aggs": {
"pool_to_cluster": {
"reverse_nested": {},
"aggs": {
"clusters": {
"cardinality": {
"field": "cluster_id"
}
}
}
}
}
}
}
}
}
}
}
