Kibana and Vega with nested aggregations - elasticsearch

Question

Given the below Vega JSON in Kibana, how can i make it dynamic such that when a user on searches for something in the search box it applies to both the query and the pos filter tags below. So let's say a user types in 'face*' in the search box then i want the values marked with <----- this to change below to dynamically change
{
"$schema": "https://vega.github.io/schema/vega/v4.3.0.json",
"autosize": "fit",
"title": "POS COUNT",
"data": [
{
"name": "data_table",
"url": {
"index": "sa_test_index_data",
"body": {
"size": 0,
"query": {
"nested": {
"path": "xforms.sentence.tokens",
"query": {
"bool": {
"should": [
{
"wildcard": {
"xforms.sentence.tokens.value.keyword": "24*" <----- this to change
}
}
]
}
}
}
},
"aggs": {
"sentence": {
"nested": {"path": "xforms.sentence.tokens"},
"aggs": {
"pos_filter": {
"filter": {
"wildcard": {"xforms.sentence.tokens.value.keyword": "24*"} <----- this to change
},
"aggs": {
"pos": {
"terms": {"field": "xforms.sentence.tokens.tag.keyword"}
}
}
}
}
}
}
}
},
"format": {"property": "aggregations.sentence.pos_filter.pos.buckets"},
"transform": [
{
"type": "collect",
"sort": {"field": ["doc_count"], "order": ["descending"]}
}
]
},
{
"name": "data_table_pie_inner",
"source": "data_table",
"transform": [
{
"type": "aggregate",
"groupby": ["key"],
"fields": ["doc_count"],
"ops": ["sum"],
"as": ["ff_sum_count"]
},
{
"type": "pie",
"field": "ff_sum_count",
"as": ["ff_inner_startAngle", "ff_inner_endAngle"]
}
]
}
],
"scales": [
{
"name": "scale_color",
"type": "ordinal",
"range": {"scheme": "category10"},
"domain": {"data": "data_table", "field": "key"}
}
],
"marks": [
{
"name": "mark_inner_ring",
"type": "arc",
"from": {"data": "data_table_pie_inner"},
"encode": {
"enter": {
"x": {"signal": "width / 2"},
"y": {"signal": "height / 2"},
"fill": {"scale": "scale_color", "field": "key"},
"fillOpacity": {"value": 0.8},
"stroke": {"value": "white"},
"startAngle": {"field": "ff_inner_startAngle"},
"endAngle": {"field": "ff_inner_endAngle"},
"innerRadius": {"value": 0},
"outerRadius": {"value": 100},
"tooltip": {
"signal": "datum['key'] + ': count ' + datum['ff_sum_count']"
}
}
}
}
],
"legends": [
{
"fill": "scale_color",
"title": "POS",
"orient": "right",
"encode": {
"symbols": {"enter": {"fillOpacity": {"value": 0.5}}},
"labels": {"update": {"text": {"field": "value"}}}
}
}
]
}

Answer 1

Slightly confused by the question, but I figure you are looking to incorporate the dashboard filters into the query body aswell. Make sure to use the %...% parameters in your query likeso.
I noticed in the comment you mention it going into the aggs. I don't think this is doable, maybe try using the %...% parameters in there?
{
body: {
query: {
bool: {
must: [
// This string will be replaced
// with the auto-generated "MUST" clause
"%dashboard_context-must_clause%"
{
range: {
// apply timefilter (upper right corner)
// to the #timestamp variable
#timestamp: {
// "%timefilter%" will be replaced with
// the current values of the time filter
// (from the upper right corner)
"%timefilter%": true
// Only work with %timefilter%
// Shift current timefilter by 10 units back
shift: 10
// week, day (default), hour, minute, second
unit: minute
}
}
}
]
must_not: [
// This string will be replaced with
// the auto-generated "MUST-NOT" clause
"%dashboard_context-must_not_clause%"
]
filter: [
// This string will be replaced
// with the auto-generated "FILTER" clause
"%dashboard_context-filter_clause%"
]
}
}
}
}