852d069a3c
* Docs: Revise data source index * Docs: Consolidate data source administration docs * Docs: Revise panels docs related to data sources * Docs: Revise Alertmanager data source * Docs: Reorganize AWS CloudWatch data source docs * Docs: Reorganize Azure Monitor data source docs * Docs: Move azuremonitor to azure-monitor * Docs: Revise Elasticsearch docs * Docs: Move Elasticsearch index into bundle * Docs: Revise GCM docs * Docs: Revise Graphite docs * Docs: Move Graphite index into bundle * Docs: Revise InfluxDB docs * Docs: Revise Jaeger docs * Docs: Move Jaeger index into bundle * Docs: Revise Loki docs * Docs: Move Loki index into bundle * Docs: Revise MS SQL docs * Docs: Move MS SQL index into bundle * Docs: Revise Prometheus docs * Docs: Move Prometheus index into bundle * Docs: Revise Tempo docs * Docs: Move Tempo index into bundle * Docs: Revise TestData DB docs * Docs: Move TestData DB index into bundle * Docs: Revise Zipkin docs * Docs: Move Zipkin index into bundle * Docs: Move other data sources' index pages into bundles * Docs: Revise frontmatter * Fixing hugo markdown errors * Docs: Add query editor and template var sections to overview doc * Docs: Remove CTAs across data source docs * Docs: Remove CTA * Docs: Remove CTA * Docs: Fix links, images, typos, and usage consistency. * Docs: Fix typos * Docs: Fix CI issues * Update docs/sources/datasources/_index.md Co-authored-by: Torkel Ödegaard <torkel@grafana.com> * Update docs/sources/datasources/_index.md Co-authored-by: Torkel Ödegaard <torkel@grafana.com> * Docs: Fix query editor links * Update docs/sources/panels-visualizations/_index.md Co-authored-by: Torkel Ödegaard <torkel@grafana.com> * Update docs/sources/panels-visualizations/_index.md Co-authored-by: Torkel Ödegaard <torkel@grafana.com> * Docs: Rebundle child pages per writers' toolkit * Docs: Fix prettier for CI * Docs: Fix relrefs from outside data sources docs * Docs: Fix broken relrefs within datasources * Docs: Fix relrefs to data sources docs * Fixed some more refs Co-authored-by: Torkel Ödegaard <torkel@grafana.com>
3.6 KiB
| aliases | description | keywords | menuTitle | title | weight | |||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Using template variables with Elasticsearch in Grafana |
|
Template variables | Elasticsearch template variables | 400 |
Elasticsearch template variables
Instead of hard-coding details such as server, application, and sensor names in metric queries, you can use variables. Grafana lists these variables in dropdown select boxes at the top of the dashboard to help you change the data displayed in your dashboard. Grafana refers to such variables as template variables.
For an introduction to templating and template variables, refer to the [Templating]({{< relref "../../../dashboards/variables" >}}) and [Add and manage variables]({{< relref "../../../dashboards/variables/add-template-variables" >}}) documentation.
Choose a variable syntax
The Elasticsearch data source supports two variable syntaxes for use in the Query field:
$varname, such ashostname:$hostname, which is easy to read and write but doesn't let you use a variable in the middle of a word.[[varname]], such ashostname:[[hostname]]
When the Multi-value or Include all value options are enabled, Grafana converts the labels from plain text to a Lucene-compatible condition. For details, see the [Multi-value variables]({{< relref "../../../dashboards/variables/add-template-variables#multi-value-variables" >}}) documentation.
Use variables in queries
You can use other variables inside the query.
This example is used to define a variable named $host:
{"find": "terms", "field": "hostname", "query": "source:$source"}
This uses another variable named $source inside the query definition.
Whenever you change the value of the $source variable via the dropdown, Grafana triggers an update of the $host variable to contain only hostnames filtered by, in this case, the source document property.
These queries by default return results in term order (which can then be sorted alphabetically or numerically as for any variable).
To produce a list of terms sorted by doc count (a top-N values list), add an orderBy property of "doc_count".
This automatically selects a descending sort.
Note: To use an ascending sort (
asc) with doc_count (a bottom-N list), setorder: "asc". However, Elasticsearch discourages this because sorting by ascending doc count can return inaccurate results.
To keep terms in the doc count order, set the variable's Sort dropdown to Disabled. You can alternatively use other sorting criteria, such as Alphabetical, to re-sort them.
{"find": "terms", "field": "hostname", "orderBy": "doc_count"}
Template variable examples
{{< figure src="/static/img/docs/elasticsearch/elastic-templating-query-7-4.png" max-width="500px" class="docs-image--no-shadow" caption="Query with template variables" >}}
In the above example, a Lucene query filters documents based on the hostname property using a variable named $hostname.
The example also uses a variable in the Terms group by field input box, which you can use to quickly change how data is grouped.
To view an example dashboard on Grafana Play, see the Elasticsearch Templated Dashboard.