Order Cols

[RPaolo]

kibana: v 7.15.2 enhanced table: v 1.13.1

divided columns; Terms: Year; Order: alphabetical descending. the order of the columns is incorrect.

To fix this I used in Settings, Json input {"min_doc_count": 0} and it worked. But when I add the query "Year> 2010" and setting {"min_doc_count": 0} it also shows me the years less than 2010 if they are present in the documents. The columns of the years <2010 all have zero values. Instead I would like the query "Year> 2010" not to show the columns for the years <2010

If I remove {"min_doc_count": 0} and apply the query "Year> 2010" it only shows me the columns of the years> 2010 but the order of the columns is incorrect.

Is there a way to display only the sorted columns and only those that match the query? es:

[fbaligand]

Hi, Well, to sort the columns, I invite you to check "Order split cols" in "Options" tab. Concerning filter for "years > 2010", I guess that your elasticsearch mapping for this field is "keyword", right? In that case, the comparison ">" or "<" does not work. You should define the years as an integer or a date to be able to use ">" or "<" operators.

If mapping is not "keyword", tell me the ES mapping. In all cases, data filtering is not tied to enhanced table plugin, but to Elasticsearch/Kibana itself.

[RPaolo]

I don't have "Order split cols" in the "Options" tab. can you show me where to find the sorting of the columns in the options?

Yes, Year is mapped as 'keyword'. Year > 2010 actually hides the columns with year <2010 but does not sort the columns by year. As you can see from the photo applying "year> 2010" the > or < works.

To sort the columns I used the Json input: the setting {"min_doc_count": 0} on the years column and IT WORKS but applying this setting the columns with year <2010 reappear

[fbaligand]

“Sort split cols” is in “enhanced settings” section. il is a new feature since enhanced table v1.13.0, and that is shown only if you have a “split cols” bucket. Without that, you can’t be sure of columns order, if you use another aggregation that “filters”. Concerning filtering, with a keyword mapping, you can’t use “<“ “>” operators. As you can see, it does not work as expected. You should change index mapping or potentially, create a sub field with “integer” mapping, or else use a scripted field that translates the value to an integer. thus, if mapping is integer, you can use “range” query to really have a bucket for every year.

[fbaligand]

Given that question is answered, I close the issue.