Kibana and fixed time spans

Question

Is it possible to set a fixed timespan for a saved visualization or a saved search in Kibana 4?

Scenario: I want to create one dashboard with 2 visualizations with different time spans.

A metric counting unique users within 10 min (last 10 minutes)
A metric counting todays unique users (from 00.00am until now)

Note that changing the time span on the dashboard does not affect the visualizations. Possible?

Can you provide more info.... – Vineeth Mohan Feb 25 '15 at 12:16 — Vineeth Mohan, Feb 25 '15 at 12:16

score 21 · Accepted Answer · edited Feb 24 '21 at 07:16

You could add a date range query to the saved search you base each visualisation on. Eg, if your timestamp field is called timestamp:

timestamp:[now-6M/M TO now]

where the time range is from 'now' to '6 months ago, rounding to the start of the month.

Because Kibana also now supports JSON-based query DSL, you could also achieve the same thing by entering this into the search box instead:

{
    "range" : {
         "timestamp" : {
             "gte": "now-6M/M",
             "lte": "now" 
         }
     }
 }

For more on date range queries see https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates

However changing the dashboard timescale will override this if it's a subset. So if you use the above 6 month range in the saved search, but a 3 month range in the dashboard, you'll filter to 3 months of data.

here's an example of how to search kibana with an absolute datetime: `@timestamp:["2016-11-28T15:00:00.000-0900" TO now-45m]` — djeikyb, Nov 29 '16 at 01:24
Any thoughts on rounding to custom window ? Like [now - 30M/5M ] — phaigeim, Dec 29 '16 at 09:16

Kibana and fixed time spans

1 Answers1