How can I query unique values from Elasticsearch with the new Grafana 13 Query Variable editor?

Grafana Dashboards
1

  • What Grafana version and what operating system are you using? 13.0.2

  • What are you trying to achieve? I want a query variable that lists all unique values from an Elasticsearch index, e.g. “give me all unique hostnames” for a filter

  • How are you trying to achieve it?

I have previously used this type of query:

{"find": "terms", "field": "client.extra_label.keyword" }

image
image1488×2492 310 KB

This would give me all client labels.

  • What happened?

I now see this window, but where am I supposed to enter the query?

image
image1448×2126 289 KB

  • What did you expect to happen?

I expected to be able to just … query the unique labels as before?

  • Can you copy/paste the configuration(s) that you are having problems with? N/A

  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were. N/A

  • Did you follow any online instructions? If so, what is the URL? I could not find any documentation matching this feature

2

The query

{"find":"terms","field":"client.extra_label.keyword"}

returns the unique values of client.extra_label.keyword using an Elasticsearch terms aggregation.

Could you confirm:

Which Elasticsearch datasource version you’re using?

Whether this variable was created from scratch or migrated from an older Grafana version?

That information help determine how the legacy find: "terms" query maps to the current variable editor.

3

Which Elasticsearch datasource version you’re using?

How do I find out? I am just using the Docker image for 13.0.2 as-is.

Whether this variable was created from scratch or migrated from an older Grafana version?

This “legacy” variable was migrated over from 12.x to 13.x.

4

PS: I have filed an issue here: Dashboards: Cannot query unique values using Elasticsearch raw query · Issue #126663 · grafana/grafana · GitHub

There are multiple things going on, I think, apart from not being able to just re-use the old type of query.

5

Ok, that was more complicated than I expected.

The new query variable DSL editor is only available when you enable the feature toggles.

elasticsearchRawDSLQuery = true
elasticsearchESQLQuery = true

And even then it doesn’t support the old Grafana internal legacy queries:

{ "find": "terms", "field": "type.keyword" }

You have to convert to:

{ "size": 0, "aggs": { "uniqueTerms": { "terms": { "field": "type.keyword", "size": 500 } } } }

And then set the value field/text field directly:

image
image1382×154 7.21 KB

I have raised these UX/docs issues on GitHub.