Did you know: that you can easily change an image in Kibana Canvas based on a query on your index using the Expression editor?

Each week, a new “Do You Know” will be posted on our Elastic Technical Knowledge Hub to share useful knowledge to improve the observability using Elasticsearch. These topics originate from day-to-day challenges we solved for our clients. A stepwise description helps you to successfully implement solutions on improving the performance of your deployment and get the best monitoring of your applications using dashboards and alerting.

This week I will discuss: how to easily change the image in Kibana Canvas depending on a query on your index using the Expression editor.

Background

Kibana Canvas is a creative way to visualize, present, and report on your data in Kibana. Imagine you want to turn a green light into red when an error occurs in your data set. Here is how to do it!

Solution

Step 1

In Kibana, open a new Canvas → Create workpad. Import two images: a green traffic light and a red traffic light. First, add an image element, then select or drag and drop an image from the panel on the right side of your window.

In Step 2, you will need the assetIDs of your images. To retrieve them, go to the ‘Add element’ menu (top left) → select ‘Manage assets’. You can copy the assetIDs from there.

Step 2

Select the image of the green light. The Expression editor will appear in the bottom right corner. Add the following expression:

image 
  dataurl={asset {filters | essql query="SELECT Severity
FROM "<index name>*" WHERE Severity='ERROR' AND "@timestamp" >= CAST(CURDATE() AS DATE)" | math "unique(Severity)" | if {lt 1} then="<asset-green_light_assetId>" else="<asset-red_light_assetId>"}} mode="contain"
| render

With the current expression in place, the red traffic light image will be called in case an error occurs during the current date.