1

I am trying to get a simple Elasticsearch aggregation visualized - the query is like this:

{
"index": "logstash-*",
"from": 0,
    "size": 10,
    "aggs": {
        "terminal": {
            "terms": {
                "field": "terminal_id.keyword",
                "order": {
                    "_count": "desc"
                }
            }
        }
    },
    "query": {
        "bool": {
            "must": [
                {
                    "query_string": {
                        "query": "log_type:ERROR"
                    }
                },
                {
                    "range": {
                        "@timestamp": {
                            "gte": "now-7d/d"
                        }
                    }
                }
            ]
        }
    }
}

Result fired directly is like this:

“aggregations”: {
“by_terminal”: {
“doc_count_error_upper_bound”: 78,
“sum_other_doc_count”: 5083,
“buckets”: [
{
“key”: “34016118”,
“doc_count”: 2524
},
{
“key”: “34016257”,
“doc_count”: 850
},

In Redashit looks like this:
34016118	TERMINAL	34016257	40011667	...
 2524       34016118									
            34016257	   850								
            40011667		           838

How can I get a normal bar visualization with the count on Y-axis and the terminal numbers on X-axis?

2

yea, so this is still an issue, are there any efforts to solve this? or at least some direction on how to implement a solution?

3

The ES data source query runner was a community contribution from several years ago. It’s rough around the edges and needs to be rewritten. I’m sure the team would welcome a pull request with updates.