How to create two levels Grafana Variable from ElasticSearch?

Question

I work on creating some Grafana dashboards. At the moment, from ElasticSearch data source.

When I am trying to create a variable in Grafana like the one below:

{"find": "terms", "field":  "myServer.name"}

I get None, instead of getting these names: heroku, k8s, aws.

I tried looking through docs and existing StackOverflow questions, but it is still unclear how I can make it work.

Am I doing it wrong, or is it Grafana's limitation?

Answer 1

I ended up with this query:

{"find": "terms", "field":  "myServer.name", "query": "myServer.name:*"}

The problem was not in the query itself but the type. If I switch myServer.name from type text to type keyword, it starts working.

As a result, I need to change the template and reindex my logs in ElasticSearch and Filebeat.