Kibana: Drill down from one visualization to another

[vg15]

Hi Experts,

It seems we do not have this feature yet on kibana 4 ,to drill down from one visualization to another . Something like if I click on overall count of events it will open detail of all those events and further if I click on any event it will open detail for that particular event only . So basically a token concept, token value should pass to the next visualization.

Another scenario would be

I have logs from arcSight , so I have base and correlated events .Now I want to drill base to correlated or Vise versa .

Trust me if we have this feature that would be really great or if you guys are already working on it please update us , we can wait for next version of kibana.

Thank you

[rashidkpc]

I'm not exactly sure what the ask is here? Is there another tool that works like this that you could give an example of?

[vg15]

Yes I have seen this feature in Splunk , though it is not free . But it provides an advance drill down option . So it provides feature like drilling down from one visualize to another or from one dashboard to another .

[vg15]

So that mean we do not have solution for this as of now..?

[rashidkpc]

There is currently no functionality like this.

[mlaferrera]

+1 for this..one of the biggest limitations I am running into when developing a workflow with Kibana.

[samuelmr]

+1

[marcinkubica]

+1

[acommendador]

+1

[tianchao-haohan]

+1
for eample, there is a pie chart visualize shows the successful http visits and unsuccessful http visits. If I click the unsuccessful part, will jump to data table that shows the detaled failed events.

[marcinkubica]

Definitelly +1 for this. Drill down dashboards!

[thunderbirdgit]

+1 Would be a nice feature

[mahdihrz]

+1

[elvarb]

A start would be to use the markdown widget containing links to different dashboards. For this to work when clicking those links the next dashboard being viewed must inherit the current dashboards searches and filters. This includes lots of manual work but it would also save work in the long run.

For example, lets say we have 5 apps, each have a similar logging structure but work completely different. You would start by creating 5 dashboards to show the most important information relevant to each app. When an error comes up all 5 apps log the same and what is important is shared between all of them so you could save time by creating one error dashboard that is accessible from all 5 main dashboards. Going from those dashboards to the error dashboard should inherit the filters the main one had.

[tianchao-haohan]

Is there a milestone for this enhancement?

[tslarkin61]

+1 We are proposing Kibana to a major client and drill down capability is a must. Personally I have worked with multiple dashboard tools with this capability including Splunk. An ideal solution would include embedding external URLs capable of passing parameters to drill into monitoring tools for a state of the art ITSM solution.

[jccq]

@tslarkin61 If i understand correctly this should be doable with the extensions to kibana we have developed (aka the Kibi project - our friendly-kibana-fork-for-relational-data)

check out the videos, might be close to what you need (and we'd be interested to know if its not!) https://www.youtube.com/channel/UCKGsC-vD28r7hW6T9QspKPA

.. so you'll be able to propose Elasticsearch and Kibi/Kibana to your major client :)

we're at Elasticon next week btw (sponsoring) so if you're around

[tslarkin61]

@jccq You understand correctly. We need to drill down from one dashboard to another dashboard and use the selection to filter into the next dashboard. Looks like you solved that design issue. Our other requirement is to drill down into other monitoring tools to execute reports based on passing parameters. Have you considered how you could handle external links associated with indexed data items?

[algefaen]

+1: A way to link from one dashboard to another in a way that preserves filters+search would be awesome.

(Kibi seems overkill for our use.)

[kcech]

+1. Would be killer feature!

[anomalizer]

grafana has such a feature in case anyone is looknig for examples
http://docs.grafana.org/reference/graph/#drilldown-detail-link

[meenalluktuke]

+1 for drilldown

[fjiang212]

+1

[jnmoons]

This is a requirement for us as well

[atul9911]

+1

[akhare22sandeep]

+1

[marbaquero]

+1

[sachinsable]

+1

[Anton-Kulikov]

+1

[Ritesh-Sharma]

+1

[xdzhou12]

+1

[ranierimazili]

+1 Seems nobody is working on it. Sad. For a huge number of companies, a dashboard where you can't do drill down is almost useless.

[marksarnold]

+1 - absolute core requirement for most of my clients

[oras]

• 1 Agree

[gangding]

Wish they could have it

[polinom]

+1
There is a huge company that is looking to switch from paid tool like splunk to ELK.
Drilldown functionality is a barrier to that switch.

[marksarnold]

+1
Also: drilldown to a raw list of events rather than a different visualization

[mvleandro]

+1

[npr72]

+1. Absolutely required.

[alexpop89]

+1

[Bazarovay]

+1

[GautamP7]

+1

[rcfontana]

+1 on fire

[AndreAga]

+1

[Sujeet1604]

+1 because we have recently started ELK and feel that it is only through X-Pack i.e. paid . Please implement this as a native feature in Kibana

[nreese]

What about a dashboard panel that contains a list of related dashboards? Clicking on the dashboard link would transfer all context (time, filters, and lucene queries) to the drill-down dashboard.

Issue #10461 is asking for a similar feature within Markdown widgets but maybe this should be its own panel type.

[varunsharma27]

@nreese You can achieve that by using markdown widget and pinning the required filters.

[obudiman]

+1

[ppseal]

+1

[obudiman]

+1

[Jal619]

Any update on this???

[stacey-gammon]

The current approach for drill down links we plan to implement is detailed here: https://github.com/elastic/kibana/issues/12560.

[segalziv]

+1

[jitendra-kumawat]

+1, for more details of drill down operations check https://community.tableau.com/thread/192365

[floatingtony]

I just found Kibana can drill down like this : https://demo.elastic.co/app/kibana#/visualize/edit/ba53d7d0-6b1d-11e7-90da-29dd6409b5ed
I prepare to drill down by this way. Are there any problem if i use the Visual Builder?

[segalziv]

The work arounds I found are either in the visualization builder or in the
field settings - you can set up the field type to URL, with a link to the
other kibana dashboard. Using the field value in the URL is possible by
teplate: {{value}}

On Mar 9, 2018 10:08 AM, "floatingtony" [e-mail] wrote:

I just found Kibana can drill down like this :
https://demo.elastic.co/app/kibana#/visualize/edit/
ba53d7d0-6b1d-11e7-90da-29dd6409b5ed
I prepare to drill down by this way. Are there any problem if i use the
Visual Builder?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/elastic/kibana/issues/4439#issuecomment-371742196,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AIm7Fqht1gmaCEeBOq5RfmXYBBnlYm80ks5tcjhkgaJpZM4FZoOv
.

[timroes]

I'll close this in favor of #12560 which keeps track about our effort about building drilldowns between dashboards.