Hidden gem: Advanced Filter

Sometimes we create hidden or debug functions in Canvas by simply not creating a UI for them. One of those hidden abilities is the "Advanced Filter" element. The advanced filter really is for advanced users since you need to know how Canvas filters work, but the gist is that it is an element that allows you to type a Canvas expression to use as a filter anywhere that the filters function is used on a workpad.

To get the Advanced Filters element you'll need to drop into the expression editor and enter:

render as="advanced_filter"

You can then type a filter expression in there. Right now filters are only used by esdocs, escount and timelion. There are currently 2 filter functions available: exactly and timefilter. You can try those out in the expression editor too, just replace filters with your own filter. For example:

exactly column=monitor.host value=road.cc | esdocs index=heartbeat*

Also, don't forget, filters are just regular Canvas expression so you can do sub-expressions. This one will use esdocs and getCell to lookup the most recent host to report in and filter a subsequent fun of esdocs to only pull back documents with that host:

exactly column=monitor.host value={esdocs index=heartbeat* sort="@timestamp,desc"| getCell monitor.host} | esdocs index=heartbeat*