Adhoc filter do not find options

Grafana Elasticsearch
1

Hi,
after the update from Grafana 6.4 to Grafana 8.1 the ad hoc filter do not show options any more after selecting a field:

grafik

The request is: https://SERVER_NAME/grafana/api/datasources/proxy/52/_msearch?max_concurrent_shard_requests=5

The reply is:

{
  "error": {
    "root_cause": [
      {
        "type": "parse_exception",
        "reason": "request body or source parameter is required"
      }
    ],
    "type": "parse_exception",
    "reason": "request body or source parameter is required"
  },
  "status": 400
}
2

Hi @jlau, I saw your question about editing your post. Posts should be able to be edited for up to 24hours by the author. That might not apply if the post is flagged for some reason and we have to manually approve it.

You can still reply to your own post and add more details or make corrections in the conversation.

Regarding your question with the elasticsearch datasource after the upgrade, I have a couple of ideas:

I’m curious if the datasource is returning query results as expected in explore? That could give us some insight into whether there might be something that needs to be updated in the datasource configuration.

I found an interesting issue if the elasticsearch datasource is your default datasource:

3

Hi @melori.arellano
finally I found some time to have a closer look into the send query, and I think I found the issue.
The request payload looks like this:

{"search_type":"query_then_fetch","ignore_unavailable":true,"index":"my_index"}
{"size":0,"query":{"bool":{"filter":[{"range":{"general.data_source_time_field":{"gte":"1654660925962","lte":"1654682525962","format":"epoch_millis"}}}]}},
"aggs":{"1":{"terms":{"field":"my_field","size":500,"order":{"_key":"asc"}}}}}

The browser dev-tool shows that the query was successful, put gives an empty result.
I think the reason ist the short time range set in "filter":[{"range":{"general.data_source_time_field":{"gte":"1654660925962","lte":"1654682525962","format":"epoch_millis"}

Make Unix time-stamp human readable shows:

  • 1654670375696 → Wednesday, 8. June 2022 06:39:35.696
  • 1654691975696 → Wednesday, 8. June 2022 12:39:35.696

So the time range is 6 hours and not the range choose in dashboard.

Now, if there is no entry in my_field for the last 6 hours (which is common in my case), Elasticsearch will give an empty result which leaves to an empty drop down for adhoc filter values.

For comparison to Grafana Version 6.4: Here the time-range filter took the time range from dashboard.
I think this make more sense.

4

@jlau thanks for sharing what you found. I wonder if this might be related to this change in elasticsearch with regards to the interval.

Which version of elasticsearch are you using and have you selected in your datasource configuration?

This past discussion, talked about using a large interval to get a single datapoint from elasticsearch to cover the range selected in the dashboard.

[Feature] Support $__range variable for Elasticsearch Data Source · Issue #13238 · grafana/grafana · GitHub - see the comment by torkelo

5

Hi @melori.arellano,
I use the Elasticsearch version 7.15 and for datasource I selected 7.10+.
I also made a Grafana update to 8.5.5 today, but the time range to find filter values is still only 6 hours.

The discussion you mentioned is about date histogram. I have not found a link to my topic.

I think this might be a bug and time range should again be broaden to dashboard time range (not only 6 hours). Otherwise Adhoc filter will not work for Elasticsearch data source.

6

I meanwhile submitted an issue in the repository