It would to great to be able to set a default implicit query/filter in a dashboard. Most of the time, a dashboard displays information about a specific scope of equipments or services. It shouldn't be necessary to prefix each query with "@type:servers" or "@tag:firewalls".
Maybe it could be done with aliases, but AFAIK, K3 doesn't support aliases in the timepicker. The other problem with aliases is that they point to a set of indices, so we would lose the efficient sequential query method that K3 uses. And there is currently no automated workflow of creation/update of aliases with filters in ES.
But this feature would be very useful.
It would to great to be able to set a default implicit query/filter in a dashboard. Most of the time, a dashboard displays information about a specific scope of equipments or services. It shouldn't be necessary to prefix each query with "@type:servers" or "@tag:firewalls".
Maybe it could be done with aliases, but AFAIK, K3 doesn't support aliases in the timepicker. The other problem with aliases is that they point to a set of indices, so we would lose the efficient sequential query method that K3 uses. And there is currently no automated workflow of creation/update of aliases with filters in ES.
But this feature would be very useful.