i'm playing timelion, kibana's plugin.
most of features works fine on my dataset except one:
cardinality
the demo in timelion's blog show
.es(*), .es(metric=cardinality:user)
in my dataset, i have a similar case: logs and city_name, i would like to replace the user with city_name, so here is what i tried:
.es(*), .es(metric=cardinality:geoip.city_name)
but the value in second graph line are all zero, even when i tried:
.es(metric=cardinality:geoip.city_name)
still same result.
but when i tried similar field:
.es(metric=cardinality:geoip.ip)
it works well, fields like "latitude", "longitude" also works well, but other string filed such as "region_name","country_name","timezone" all turns out to be 0.
the only difference i can see is the different data type:
type with float and ip works well
string type can not work
my question is if it's possible to use string field as cardinality.
after a deep look, turns out the field which cardinality calculation is against to should not be analyzed, this is why string filed is failed.
simply replace geoip.ip with geoip.ip.raw solved my problem.
Related
When sending a request to https://autocomplete.geocode.ls.hereapi.com/6.2/suggest.json?query=Вильнюс with an indication of cyrillic nothing comes and with a latin https: //autocomplete.geocode.ls.heraapi.com/6.2/suggest.json?query=Viln all is well. Tell me what the problem is or what I'm doing wrong?
You're not doing anything wrong. Autocomplete is designed to give you addresses that contain (perfectly match) your input string, and the results are sorted by relevance.
When you make your query in russian and provide only "Вильнюс" as input, the service is finding a lot of results (street names) that it considers are more relevant than the city. The city name is also found, but since the service doesn't think that this is what you're searching for, it puts the city much lower in the results list. You don't see it because you're limiting your query to give you only the first 10 matches (with the maxresults=10 parameter), but if you change the maxresults parameter to 20, for example, you will see that Vilnius appears in the 16th place of the API response.
If you want the service to better understand what is the thing you're querying for, you'll need to provide additional information. For example, if you continue typing and your input string is now "Вильнюс " (with a space at the end) or "Вильнюс Л" (a space and another letter), the service will understand what you mean and will return the result you want.
Another way of providing more information to change the way the service ranks the results is by adding a spatial filter, like the country, mapview, or prox parameters mentioned in the API Reference section of the documentation. Alternatively, the resultType parameter can help you filter out all the results with street names and return only city names, if that's what you want. These are just some options available, the one that is right for you will depend on your use case.
I'm brand new to Power BI and I'm not sure if I'm doing something wrong, but I would expect a "date/time" field would have special options for filtering. However, the filter actually lists a dropdown of all values ("2015-09-24 12:00:01", "2015-09-24 12:00:02", "2015-09-24 12:00:03", etc).
How can I filter by "last year" or "last 7 days"? Am I missing something simple?
I have tried in the web interface and Desktop.
You need to set the field's data type to Date/Time. If you're seeing strings, the most common issue is that in the query the field is defined as type "any", which gets interpreted as a string. So just go to the query window, change the data type for the affected columns, and see what happens. One little hint, is that usually after you use a function or transform (especially Add Column!) the resulting column will have the "any" data type. So double check and set the data type you really want.
I am having a field named rpc in my elasticsearch database and I am displaying it using Kibana. When I search in search bar of kibana like:
rpc:*
It display all the values of rpc field but I want to have only those value to be displayed which are unique.
I have been playing around with Kibana4 since a couple of weeks now. I find it intuitive and simple and the experience has been great till now. Following your question, I tried getting unique results via a Data Table visualization. Why? Because I personally find it easier to understand. Following are the steps:
1. Get unique count
Create the visualization (Visualize -> Data Table). First lets get
the count of how many unique entries we have for a particular field
(We will use this in the later part for verification). I'm using
clientip.raw but as I see, it will work just fine with any friendly
field name too.
2. Set the aggregation right
Set you aggregation back to count and have a Split Rows as follows. Not doing this will give you count 1 for each field value (since it is looking for unique counts) when you populate the table. Noteworthy part is setting the Top field to 0. Because Kibana won't let you enter anything else than a digit (Obviously!). This was the tricky part. Hit Apply and you'll get the results. Unique field values and the count of each of them.
3. Verification:
Going to the last page of the table, we see there are exactly 543 results. This is how I know it works.
What Next?
You save this visualization and add it to a Dashboard. There you can always check the request, query, response and other stats.
Just an addition to the above mathakoot answer.
For the user of newer version (which do not allow bucket size of 0 anymore) just set a value greater than the maximum number of result
And report the value in the Options>Per Page field
I am using Kibana 6 so the UI looks a bit different than the older answers here.
Here is what worked for me
Create a visualization from your query, I used a line graph type (don't think it matters)
Under Data, set metrics aggregation = "Unique Count" and set field to your field.
Set x-axis aggregation = "Terms" and set field to your field.
Set Size > your number of records
Under Metrics and Axes, disable drawing of the graph, circles, and labels (this really helps the UI not lag)
Run query and then click "Inspect" and download CSV
Data
Metrics & Axes
I wanted to achieve something similar but I'm stuck with Kibana 3.1.
I simply added a panel of type "TERMS" and configured its Field = User-agent and left everything else on default values. This gave me a nice bar chart with one bar for each User-agent.
I curled the sample bank data to elasticsearch. On Kibana I see under the Indices bank and on visualize all the fields (age, balance, etc.) on the left but cannot see charts on the right. It always says No Results Found. On the left I selected Y-Axis - Agg as Average and Field as Balance and X-Axis Agg as Terms and Field as Age, all from drop downs. Then I used the APPLY action. No error is displayed, but neither is a chart.
What am I doing wrong here? Using curl I can check the elastic search and see that the data exists. No matter what I do, I do not see any logging in the elasticsearch logs under /usr/share/elasticsearch/logs.
I don't know if you figured this out or not but I had the exact same problem. I was using a mapping type that did not contain the field I was trying to visualize. Make sure the _type field contains a mapping with the correct indexed fields.
When setting up my initial index patterns, I glossed over specifying the 'Default timestamp' field, and the UI didn't insist on having one. The fix was to delete my index patterns and re-create them them, with the specified timestamp field. Everything snapped into place.
Long time reader etc,
I've a TFS report that I want to alter the sorting on by date. The problem is the sort only seems to consider the day element and the rest isn't considered. For example, the following is happening:
1/7/2011
1/7/2011
1/7/2011
2/12/2010
3/03/2011
3/03/2011
I've looked for a way to specify the datatype on the box in the table but to no avail. Any suggestions?
I've realised the field was being treated as text as the date in question isn't guaranteed to be there and replaced with an empty string if it wasn't.
Two steps have fixed the problem:
Added calculated field to dataset and wrapped an iif around to deal with missing dates as being way off in the future.
=CDate(IIf(IsDate(Fields!My_Date.Value), Fields!My_Date.Value, DateAdd(DateInterval.Year, 10,Now)))
This then forces the field to be treated as a date. I then added a sort on the group on this calculated field which isn't shown in the report and gives the impression that those items with a date get ordered and the rest are left to the other layers of sorting which is correct.
Is there a better way of doing this?
I find it a very efficient way!
I did it myself more complex
Group properties of the field you want to sort on
Sorting
expression:
=Datepart("yyyy",Fields!Datum.Value) & Datepart("m",Fields!Datum.Value) & Datepart("d",Fields!Datum.Value)
It will sort first on year, then on month, then on day