Add support for selecting saved searches visualization editors

[eprothro]

TSVB is fantastic.

However, in a real-world ELK stack, the decoupling achieved by tying visualizations to saved searches is critical for maintainability.

Would be excellent to have the ability to select a saved search for the TSVB, as with any other visualization.

Gherkinized, what I would hope to see:

Given that I'm creating a new visualization
When I select TVSB
Then I can choose a an index or a saved search
And that saved search populates the Series Panel filter
And that saved search or index populates the Series Index Pattern

When I add a new series
Then I can choose a an index or a saved search
And that saved search populates the new Series' Panel filter
And that saved search or index populates the new Series' Index Pattern

[leonardoaranda]

+1

[parisamir]

This would be really appreciated.

[priyasubburaj]

+1

[TRISAF]

+1

[raj467690]

+1

[mrkjellqvist]

+1

[mazherChoudhury]

+1

[willemdh]

Without this functionality, using tsvb visualisations in dashboards containing other visualisations linked to saved searches, become inconsistent when the saved search would change. Every tsvb visualisation panel filter in a dashboard would have to be updated separately with every saved search change.

[digressionary]

• 1

[TheSecMaven]

+1

[joniba]

+1

[MakoWish]

+1

[thoma01]

+1 From the team at Hitachi ID Systems

[bradvido]

+1 from a guy that prefers to change things in one place

[dej611]

It is possible to replicate the same behaviour using a saved query in Lens.

[MakoWish]

A lot of interest in this, and it is closed as "not planned"?? Elastic is more and more not seeming to care about community input. That is upsetting!

[MakoWish]

It is possible to replicate the same behaviour using a saved query in Lens.

It is not possible. Updating a Saved Query does not update any visualizations that were based on that Saved Query. This has been discussed in depth before. There needs to be a way to link TSVB's and Lens visualizations to a "Saved Search". There is no existing workaround.

2024-08-21_10-21-18.mp4

[teresaalvarezsoler]

@MakoWish thanks for your input.

TSVB is considered legacy and it will be deprecated in the future (when we add some of its missing functionality into Lens) so we will not add any new functionality to it. If there are any features you are missing from TSVB in Lens please let us know so we can discuss adding them.

Regarding the request to apply Saved Searches for Lens, I reopen this other issue #55896. However, we need to think how this works with ES|QL saved searches because that's the future so how we implement this will likely change in the near term.

[MakoWish]

If there are any features you are missing from TSVB in Lens please let us know so we can discuss adding them.

Data-driven Markdown capabilities with CSS. I have literally hundreds of TSVB visualizations with CSS-styled, data-driven Markdown.

[markov00]

Hey @MakoWish, could you share a bit more about the type of CSS style you are applying in your Markdown? It would be great to understand the details of that styling and the reason for it.

Thanks

[MakoWish]

To explain the "hundreds" or TSVB's... we have 11 Spaces for 11 different teams within our IT department, and in total, we have somewhere in the ballpark of around 100 data sources feeding into Elastic. Each of those ~100 data sources have a set of dashboards, but the "landing" dashboard for each of those is an "Overview" of sorts. That overview details how many of each type of events exist using a Markdown TSVB that mimics a "Legacy Metric" visualization. Where TSVB goes beyond the Legacy Metric visualization is creating a custom hyperlink to the dashboard detailing the metric. Here is a sample screenshot of the "Overview" dashboard for our DLP solution:

Each of those metrics within the red box is a Markdown TSVB that is also a hyperlink to the respective details dashboards. For instance, if you click on the "2,898,230 File Events" metric, it will take you to a dashboard detailing those file events.

Here is the CSS applied to all of these "Metrics" being done via Markdown TSVB:

& {
    text-align: center;
    h1 {
        margin-top: 0px;
        margin-bottom: 0px;
    }
    a {
        text-decoration: none;
    }
}

And the Markdown itself where file_events is a Count of event.dataset: file:

# [**{{file_events.last.formatted}}**](../app/dashboards#/view/c22debf0-32ba-56ea-8950-499d2222a0a8 "Xxxxxxx File Events")
[{{file_events.label}}](../app/dashboards#/view/c22debf0-32ba-56ea-8950-499d2222a0a8 "Xxxxxxx File Events")

As mentioned, we have literally hundreds of these throughout our environment, so if TSVB's Markdown is ever deprecated/removed, it will destroy our entire five years' worth of dashboard design. Regardless of whether or not TSVB is ever deprecated, I know the push is to use Lens, so it would be nice to replicate this in Lens with data-driven, CSS-styleable Markdown.

[teresaalvarezsoler]

@MakoWish Thank you very much for the detail explanation, this is super useful for us. We will indeed consider all these feature gaps that currently exist and try to make the transition as smooth as possible and include as much automation as possible to avoid a lot of work on your end to migrate.

[teresaalvarezsoler]

@MakoWish after taking another look at this, we are realising some styling options in 8.16 for the metric in Lens that will provide a similar look to what you have in TSVB. You can also use the "Go to URL" Drilldowns to navigate to another dashboard when clicking in the metric so most of these things are already provided unless we are missing anything.

[MakoWish]

Drilldowns are cumbersome and not a good replacement for a clickable visualization like I detailed above. We have tried on several occasions, and our users have had nothing but negative feedback on drilldowns, so we no longer even attempt to use those since TSVB's markdown provides a perfectly-functioning solution.

[teresaalvarezsoler]

thanks @MakoWish. It would be very useful if you can elaborate the exact issues you had with drilldowns. The "Got to URL" option with a "Single click" should work exactly the same as the links you have in Markdown.

[MakoWish]

I just tested creating a drill-down as you illustrated on a Legacy Metric (via Lens). The cursor does not change to a hand (indicating a link), clicking does nothing, and I see no options in the visualization's context menu for anything related to a drill-down unless I go to Edit mode on the dashboard. In Edit mode, I get the option to create or manage drill-downs, but in view mode, this does nothing.

EDIT: I tried both the "Legacy Metric" in Lens, as well as the "Metric" in lens (even though I do not like that you cannot center the text and value like the "Legacy Metric", and neither case worked as you are describing.

In addition to this use-case, we have some complex CSS-styled, data-driven "Landing" pages with embedded images that cannot be replicated outside of TSVB. Here is one of those examples:

The company logo is embedded via Base64:

To note... we are Platinum customers, so if you would like to jump on a call to see our use cases, please let me know, and we can schedule a meeting. Again, the CSS-styleable, data-driven Markdown is very useful for us, and it cannot [yet] be replicated outside of TSVB.

[teresaalvarezsoler]

Thanks @MakoWish, yes, let's organize a call. I contacted the account executive to schedule it.

The cursor does not change to a hand (indicating a link), clicking does nothing, and I see no options in the visualization's context menu for anything related to a drill-down unless I go to Edit mode on the dashboard. In Edit mode, I get the option to create or manage drill-downs, but in view mode, this does nothing.

This can happen if you input a URL with the wrong format e.g., if you insert www.elastic.co the link won't work, you need to write the full URL like this https://www.elastic.co. We have an open issue to validate the format that will be worked on soon #163641