I have the IIS logs in Elasticsearch and I want to use a Pie Chat to show the TOP X of the countries that visit my website.
Here’s how I configure the Query part:
It’s not well sort and there’s still results with 0 count.
Did I miss some thing ?
I use quite the same to show the different response codes (400/500/200/…) and it works well (I use the term “response.raw” like this one).
Finally figured out the problem here. Table columns in Grafana can be sorted in ascending or descending order and this overrides the sorting from the query. If they are sorted then they have an arrow beside the header name:
If you click a few times on the column header you can remove the sorting:
and then the result should be sorted as you expect.
If you look at the raw response in the network tab with Chrome Developer tools, is it sorted correctly there? Is it the Piechart that has a bug or it your query from Elasticsearch that isn’t sorted correctly?
Look for the _msearch response and check the Preview or Response tab for the response:
I just understand why it didn’t show what I want. In the Pie Chart Option, The Value configuration was on “current” and I want to see the “total” count.