How to create two levels Grafana Variable from ElasticSearch?

Question

I work on creating some Grafana dashboards. At the moment, from ElasticSearch data source.

When I am trying to create a variable in Grafana like the one below:

{"find": "terms", "field":  "myServer.name"}

I get None, instead of getting these names: heroku, k8s, aws.

I tried looking through docs and existing StackOverflow questions, but it is still unclear how I can make it work.

Am I doing it wrong, or is it Grafana's limitation?

please show mappings docs object in elastic – Nikolay Baranenko Oct 20 '22 at 15:55 — Nikolay Baranenko, Oct 20 '22 at 15:55

score 2 · Accepted Answer · edited Oct 26 '20 at 04:51

2

I ended up with this query:

{"find": "terms", "field":  "myServer.name", "query": "myServer.name:*"}

The problem was not in the query itself but the type. If I switch myServer.name from type text to type keyword, it starts working.

As a result, I need to change the template and reindex my logs in ElasticSearch and Filebeat.

edited Oct 26 '20 at 04:51

Amit

answered Oct 22 '20 at 12:00

Dmytro Chasovskyi

1

Glad you found the solution, hope you also understood the concepts :) – Amit Oct 26 '20 at 04:52
field type is name? can show mappings of docs object – Nikolay Baranenko Oct 20 '22 at 15:56

1 Answers1