Kibana: Filter Greater Than Count

[k2xl]

In Kibana, I created a Table visual.

I want to count the number of records aggregated by a field (hostname).

I want to be able to filter the results where the Count>X.

However, typing Count>:10 in the kibana search yields zero results.

[LeeDr]

You should be able to use something like this in the Advanced JSON field {"min_doc_count": 10}

[thomasneirynck]

To @LeeDr 's comment, you can inject this field here:

See also https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_minimum_document_count_3 for more info.

More generally, this functionality is similar to a HAVING-clause in SQL. Elasticsearch supports this functionality using the bucket_selector pipeline-aggregation. (https://www.elastic.co/guide/en/elasticsearch/reference/master/search-aggregations-pipeline-bucket-selector-aggregation.html).

This is not supported by Kibana. Support for pipeline aggregations is an outstanding improvement https://github.com/elastic/kibana/issues/4584.

[k2xl]

What about anything with Count

[LeeDr]

I'm not seeing anything in the docs that would filter only aggregations with counts less than some number. If you really need this you might have to ask on the Elasticsearch forum here;
https://discuss.elastic.co/c/elasticsearch

[D-Skywalker]

What about anything with Count = X.
Count < X would be nice too.

The point is: I really need use the both features described above and I am looking for a answer since two days ago... If is really impossible insert this logic on Kibana visualizes, ok I will just stop to look, but the problem is that I have large difficulties to accept that it is impossible, because seems to be some simple thing, so I'm still looking for it.

Could someone give me a definitive answer?

[LeeDr]

If you're running a recent version of the stack, you could check out the Visual Builder visualization type. It might allow you to filter on the aggregated count.