Elasticsearch define template variable (from nested field)

hello, I have on ElasticSearch side the following json doc:

...
'linux': {
      'uname': 'bob'
}
...

I want to define a template variables that gather all uname values:

{"find": "terms", "field": "linux.uname"}

Noted here I use linux.uname refer to the field name, I am not sure if this causes the problem, but all it returns from preview is All, not anything specific. I tried to provide "size" option, doesn’t help either.

Am I suppose to see a list of values in preview? Do I have to actually use this variable in some panel definition to see the output?

Any help is much appreciated.

Oliver

Yes, you should see the actual fetched values in the preview.

The way your data is indexed in elasticsearch makes a difference on how you can query it.
The elasticsearch default for a string would be a textfield + a keyword field.
For more info on the difference between text and keyword:

For your grafana usecase, this will probably work:

{"find":"terms","field":"linux.uname.keyword"}
1 Like

that seems to be the exact problem - I wasn’t quite aware the difference; Not to excuse myself the ignorance, Grafana’s doc should really note this as this seems to be the common case. thanks again.