ElasticSearch-Kibana：按键过滤数组

Question

I have data with one parameter which is an array. I know that objects in array are not well supported in Kibana, however I would like to know if there is a way to filter that array with only one value for the key. I mean :

This is a json for exemple :

{
  "_index": "index",
  "_type": "data",
  "_id": "8",
  "_version": 2,
  "_score": 1,
  "_source": {
    "envelope": {
      "version": "0.0.1",
      "submitter": "VF12RBU1D53087510",
      "MetaData": {
        "SpecificMetaData": [
          {
            "key": "key1",
            "value": "94"
          },
          {
            "key": "key2",
            "value": "0"
          }
        ]
      }
    }
  }
}

And I would like to only have the data which contains key1 in my SpecificMetaData array in order to plot them. For now, when I plot SpecificMetaData.value it takes all the values of the array (value of key1 and key2) and doesn't propose SpecificMetaData.value1 and SpecificMetaData.value2.

If you need more information, tell me. Thank you.

Answer 1

you may need to map your data to mappings so as SpecificMetaData should act as nested_type and inner_hits of nested filter can supply you with objects which have key1.

PUT envelope_index
{
    "mappings": {
        "document_type": {
            "properties": {
                "envelope": {
                    "type": "object",
                    "properties": {
                        "version": {
                            "type": "text"
                        },
                        "submitter": {
                            "type": "text"
                        },
                        "MetaData": {
                            "type": "object",
                            "properties": {
                                "SpecificMetaData": {
                                    "type": "nested"
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}

POST envelope_index/document_type
{
    "envelope": {
        "version": "0.0.1",
        "submitter": "VF12RBU1D53087510",
        "MetaData": {
            "SpecificMetaData": [{
                    "key": "key1",
                    "value": "94"
                },
                {
                    "key": "key2",
                    "value": "0"
                }
            ]
        }
    }
 }

POST envelope_index/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "inner_hits": {},
            "path": "envelope.MetaData.SpecificMetaData",
            "query": {
              "bool": {
                "must": [
                  {
                    "term": {
                      "envelope.MetaData.SpecificMetaData.key": {
                        "value": "key1"
                      }
                    }
                  }
                ]
              }
            }
          }
        }
      ]
    }
  }  
}