Support Bucket Selector Aggregation to allow filtering of Data Table visualization

[bczifra]

Support Bucket Selector Aggregations to allow filtering of data table visualizations.

[chemeugene]

+1

[thomasneirynck]

seems to be specific example of #17544

[yinrong]

+1

[ppf2]

One use case for this feature is to workaround Elasticsearch not having a non-negative option for derivative aggregation so that charts can end up showing negative derivative values (upon intentional server restarts): elastic/elasticsearch#15542

[vivekkarne]

+1

[kgipe-impact]

I would love to be able to filter my dashboard to only data for the things with the highest count, or the highest sum of some metric. In other words, show me the dashboard only for the Top N things in my dataset...

[botzill]

Any updates on this ?

[boubou191911]

+1

[sachin-frayne]

+1

[hugostarnaud]

+1

[rule88]

Another use-case: https://discuss.elastic.co/t/how-to-display-only-positive-values-after-a-tophit-latest-aggregation/262997

imho this feature doesn't seem to be limited to Data-Table, as this feature might apply on other chart types in combination with last values (Top-Hit)

[spak0022]

+1

[markov00]

This probably can be implemented with ESQL

[elasticmachine]

Pinging @elastic/kibana-esql (Team:ESQL)

[upatidar7]

+1 , need to filter data after aggregation where sum or avg > n

[elasticmachine]

Pinging @elastic/kibana-visualizations (Team:Visualizations)

[mbondyra]

This is now possible using ES|QL on Lens visualizations (starting 8.14). To create one, head to discover and choose ES|QL from the data view picker. The example code I used is (only shows the buckets with more than 7000 bytes in total):

FROM kibana_sample_data_logs
| STATS total_bytes = SUM(bytes) BY geo.dest
| WHERE total_bytes > 7000 

You can adjust your visualization and then save the visualization to a dashboard.