Search code examples
elasticsearchkibanakibana-4

Kibana and fixed time spans

Is it possible to set a fixed timespan for a saved visualization or a saved search in Kibana 4?

Scenario: I want to create one dashboard with 2 visualizations with different time spans.

  1. A metric counting unique users within 10 min (last 10 minutes)
  2. A metric counting todays unique users (from 00.00am until now)

Note that changing the time span on the dashboard does not affect the visualizations. Possible?

Solution

  • You could add a date range query to the saved search you base each visualisation on. Eg, if your timestamp field is called timestamp:

    timestamp:[now-6M/M TO now]

    where the time range is from 'now' to '6 months ago, rounding to the start of the month.

    Because Kibana also now supports JSON-based query DSL, you could also achieve the same thing by entering this into the search box instead:

    {
    "range" : {
         "timestamp" : {
             "gte": "now-6M/M",
             "lte": "now" 
         }
     }
 }

    For more on date range queries see https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates

    However changing the dashboard timescale will override this if it's a subset. So if you use the above 6 month range in the saved search, but a 3 month range in the dashboard, you'll filter to 3 months of data.