Grafana Variables Query using ElasticSearch - Filter doesn't work

am currently using Grafana v9.1.7 and ElasticSearch 8.4.2

What I’m trying to achieve is to create a dashboard that can filter the data by country. I have a keyword field named honeypot_country (it’s a string that mapped into keyword in elastic). When this filter is selected, it should only provide set of data filtered by that country

I already tried to create a variable query to filter these data. But it doesn’t filter as I want to. So, I hope anyone can help me with this issue. Thanks


Please share es query that uses that variable

This is the JSON configuration when I press “Query Inspector”

"targets": [
      "alias": "",
      "bucketAggs": [
          "field": "fields.analyzer_id.keyword",
          "id": "2",
          "settings": {
            "min_doc_count": "1",
            "order": "desc",
            "orderBy": "_count",
            "size": "0"
          "type": "terms"
          "field": "time",
          "id": "3",
          "settings": {
            "interval": "auto",
            "min_doc_count": "0",
            "timeZone": "utc",
            "trimEdges": "0"
          "type": "date_histogram"
      "datasource": {
        "type": "elasticsearch",
        "uid": "1d8b2X44k"
      "metrics": [
          "id": "1",
          "type": "count"
      "query": "",
      "refId": "A",
      "timeField": "time"

And this is how I do the query using ElasticSearch. I didn’t write custom any lucene query for most of the visualization

You would need a where clause that uses the country variable otherwise grafana cant automagically use that filter

Hi @yosiasz , can you help me providing an example?

check this out

Hello! Thank you for the link that you provided. Unfortunately, adding the query makes the data doesn’t appear properly. I would like to filter by country and sometimes see the data without the filter. Is it possible?

you are comparing the variable against itself ? I Think you need

{ honeypot_country: $honeypot_country }

Works like a charm! Thank you very much for your help! :blush:

1 Like