Unable to modify label in query

[bogdanbarzu]

Hi *, I'm new to Kibana3/logstash/elasticsearch, I just wanted to give them a try. This post is just a Question, but apparently I cannot tag it myself as such.

What I did:

• first I pumped a 2 days Apache log with nc into logstash (which saved it all into elasticsearch) by setting the input of logstash to: input { tcp { type => "apache" port => 3333 }}
• I started Kibana3 for the first time and let kibana3 to build me a dashboard according with my data
• then I restarted logstash to take input from the keyboard: input { stdin { type "human" } }

If I search with curl, I can find both my data. But I could not modify my widgets in my kibana3 dashboard to also include the _type:human tagged entries, it always returns only the _type:apache entries. If I look in the query inspector window, I always get something like "{"terms":{"_type":["apache"]}}" in the "filter" section. That is probably why.

Does anyone knows how can I modify the queries of the widgets to include the new "_type" tag values?

[rashidkpc]

You need to add a 'filtering' panel and remove the _type:apache filter

[bogdanbarzu]

Oh, so easy? :) Thank you! Now I understand: clicking on a chart widget (like a slice of a pie), will add a corresponding filter (the kind of data represented by that pie slice). I need a filters widget to be able to control them.