Panel that shows the latest value of a field

[elvarb]

In some cases you want to have a dashboard that shows the latest value of a field. For example you have concurrent connections and want the Ops team to see the current status at a glance. Same if you have calls waiting from the phone system. Would work well with the metric filter also.

Letter size scale to the size of the panel. Custom font color. Possibly if it's a number a different color if the value is greater than some value.

[elvarb]

@damianharvey could you explain better how you do this? it actually looks to be very usable in some cases, looks fantastic visually also.

[bbeda]

+1

[rashidkpc]

We're implementing this as a metric agg, vs a whole new panel. Replacing with https://github.com/elastic/kibana/issues/6877

[mahepate]

+1

[hilocark]

+1

[karthikbaputj]

+1, Do we know when this enhancement will officially be made available ?

[Bargs]

@karthikbaputj 5.3 https://github.com/elastic/kibana/pull/7302

[karthikbaputj]

Thank you @Bargs , Is top_hits only supposed to work on Data table visualization ? If I try to use it on Pie charts it's able to query data but not rendering the chart. Would we be supporting other visualizations in future ?

[Bargs]

@karthikbaputj top hits should work on pie charts. Could you please open a new ticket with details about the issue you're seeing?

[jbgi]

@Bargs it looks like top_hits on non-number fields only works for table and metric (hard-coded!!) : https://github.com/elastic/kibana/blob/84ea50220535925ed3acd12b62c1681dbf435e01/src/ui/public/agg_types/metrics/top_hit.js#L28 Would be nice to allows other visualization plugins to use it...

[Bargs]

@jbgi I agree, it would be nice if each vis could tell top_hits what type of data it supports. Feel free to create a new ticket with more info about your use case and we might be able to figure something out.

[slavik57]

I created a visualization using the demo Kibana app to show the last status for ports:

• I used the table visualization
  • Metric:
  • Aggregation: Top Hit
  • Field: status
  • Aggregate With: Concatenate
  • Size: 1
  • Sort On: @timestamp
  • Order: Descending
  • Split Rows:
  • Aggregation: Terms
  • Field: port
  • Order By: Term

The only thing that I'm missing is to sort the results by the status in case I have a lot of ports and I'm just showing the top 10 results in which case I might miss the errors. But if I show all the ports there is no problem

[Sjaak01]

Came here searching for a way to do this and rather shocked that over 4 years later something basic as this still doesn't appear to be possible without jumping through many many hoops.

[Bargs]

@Sjaak01 what do you need to do that the Top Hit metric does not provide?

[yehosef]

I think the issue is that you have to do some extra steps each time:

• Aggregation: Top Hit
• Field: status
• Aggregate With: Concatenate
• Size: 1
• Sort On: @timestamp
• Order: Descending

When you could just have

• Aggregation: Last Value
• Field: status

For a common use case, it's nice to have "short-hand" or helper widgets so I can use it in the simple way I think about it. I just know that I want the last value, instead of "I want the last value so I have to use one of the aggs to get it, and I have to set some options, so it's the right value, etc."

Additionally, if you then wanted to rewrite it at some point to use a simple query instead of aggregation, it wouldn't affect the user experience - they just want the "Last Value".

[Bargs]

@yehosef after you select Top Hit, the only value you have to specify is "Field". Once you select your field, "aggregate with", "size", "sort on", and "order" all get set to sensible defaults automatically. So I don't see how the current Top Hit metric is any more burdensome than your proposed "Last Value" shorthand. If the issue is with the form simply being too complex for 90% of use cases, we could consider hiding some of the options in the "Advanced" drop down.

[yehosef]

I see what your saying - it seems the current top hits implementation is sort of optimized for the Last Value case. As a note, if you the field you choose is number, the aggregate is not pre-selected to "concatenate" - but all the other types it is (not sure if that's intentional).

I don't think I would would hide the options under advanced - I think that confuses the other valid uses of top hits.

Personally I think it still would be better to have a short-hand since it seems to be a common use case - it's not intuitive that if I want the latest value I would choose a top hits aggregation. After I know it's there, you're right, it's not that much work to do. But I still think it not so clear. Take a few new Kibana users and ask them to make a metric with the current/latest value of a certain field - I'll be very surprised if they would say "oh, I think I should use the Top Hits aggregation for that." It's clever that it works, but it's not intuitive.

On Wed, Jan 24, 2018 at 8:25 PM, Matt Bargar notifications@github.com wrote:

@yehosef https://github.com/yehosef after you select Top Hit, the only value you have to specify is "Field". Once you select your field, "aggregate with", "size", "sort on", and "order" all get set to sensible defaults automatically. So I don't see how the current Top Hit metric is any more burdensome than your proposed "Last Value" shorthand. If the issue is with the form simply being too complex 90% of use cases, we could consider hiding some of the options in the "Advanced" drop down.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/elastic/kibana/issues/678#issuecomment-360227604, or mute the thread https://github.com/notifications/unsubscribe-auth/AAJHBR-fd79bHBxYpnXEAdWpgBPDKOFjks5tN3WPgaJpZM4BL_9n .

[Bargs]

@yehosef I'd recommend creating a new Github issue so the team that works on Visualize can consider it. This sounds like an enhancement request to me, and it won't get much attention buried in this closed issue.

[yehosef]

good point - thanks.

On Thu, Jan 25, 2018 at 1:00 AM, Matt Bargar notifications@github.com wrote:

@yehosef https://github.com/yehosef I'd recommend creating a new Github issue so the team that works on Visualize can consider it. This sounds like an enhancement request to me, and it won't get much attention buried in this closed issue.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/elastic/kibana/issues/678#issuecomment-360303216, or mute the thread https://github.com/notifications/unsubscribe-auth/AAJHBUbZ96SyYVMau3AV9ECSjclrB7fhks5tN7YIgaJpZM4BL_9n .

[Sjaak01]

@Bargs It doesn't work on most fields for some reason.

I got various string fields with a text and keyword mapping and for some reason only one of them works (both text and keyword) but some other fields I have, also with a text and keyword mapping, don't display. The fields that don't display work fine in other visualizations. Of course there is data for the time range.

However as somebody else mentioned earlier in some cases you also want to only show the last value, regardless of the time range so even if this would work, it isn't a complete solution.

Not showing anything.

edit: tried with a different index and that seems to be working fine (different data but various field types, all work). Could this be some kind of bug?

[Bargs]

@Sjaak01 I would open a separate issue for your field problems with top hits so the vis team can investigate

[sgpinkus]

@Sjaak01, @Bargs same issue here. Is it missing/null values? Seem a lot like #7189. Can't see how you deal with that from reading above discussion. Any ideas?