[OSD] Vega: Unrecognized function: kibanaRemoveFilter

This came from Vega: Unrecognized function: kibanaRemoveFilter, i didn’t find a way to move posts or remove tags

Hello,

I get a visualisation error in Kibana:
Unrecognized function: kibanaRemoveFilter

The Vega code for the visualisation is below. It worked before we upgraded Kibana to OpenSearch 2.2.1

Would anyone know how to make this work again ?

{
  "$schema": "https://vega.github.io/schema/vega/v5.json",
  "description": "Treemap.",
  "padding": 30,
  
  "config": {
    "kibana": {
      "hideWarnings": true // avoid showing warnings, e.g. when there is no data 
    }
  }

  "signals": [
    {
      "name": "aspectRatio", "value": 1.6,
      "bind": {"input": "range", "min": 1, "max": 5, "step": 0.1}
    },
    {
      // reserve some place for the "Back" button
      "name": "tree_height",
      "update": "height-10"
    },
    {
      // get the name of the shortest path from "shortest_path" data
      "name": "parentpath",
      "update": '''
      isDefined(data('shortest_path')[0]) ?
      data('shortest_path')[0].argmin_length._source.path : ''
      '''
    },
    {
      // get the day of the last timestamp
      "name": "last_day",
      "update": '''
      isDefined(data('last_timestamp')[0]) ?
      dayofyear(data('last_timestamp')[0].max_date) : -1
      '''
    },
    {
      // check if parent path is a leaf
      "name": "is_leaf",
      "update": '''
      isDefined(data('shortest_path')[0]) ?
      data('shortest_path')[0].argmin_length._source.leaf : 'no'
      '''
    },
    {
      // toggle scale
      "name": "logarithmic",
      "value": false,
      "on": [
        {
          "events": "@toggle:click",
          "update": "!logarithmic"
        }
      ]
    }
    {
      // change the filter after one of the rectangles was clicked
      "name": "add_filter",
      "on": [
        {
          "events": "@nodes:click",
          "update": '''
          kibanaRemoveFilter(
          {
            "wildcard": {
              "path": datum._source.parentpath+"*"
            }
          }, 'eosmon_resmon_*')+
          kibanaAddFilter(
          {
            "wildcard": {
              "path": datum._source.path+"*"
            }
          }, 'eosmon_resmon_*')
          '''
        }
      ]
    },
    {
      // change the filters after the "Back" button was clicked
      "name": "go_back",
      "on": [
        {
          "events": "@button:click",
          "update": '''
          parentpath != '/eos/' ?
          (is_leaf == 'no' ?
          kibanaRemoveFilter(
          {
            "wildcard": {
              "path": datum._source.parentpath+"*"
            }
          }, 'eosmon_resmon_*')+
          kibanaAddFilter(
          {
            "wildcard": {
              "path": datum._source.grandparentpath+"*"
            }
          }, 'eosmon_resmon_*')
          : kibanaRemoveFilter(
          {
            "wildcard": {
              "path": datum._source.path+"*"
            }
          }, 'eosmon_resmon_*')+
          kibanaAddFilter(
          {
            "wildcard": {
              "path": datum._source.parentpath+"*"
            }
          }, 'eosmon_resmon_*'))
          : 0
          '''
        }
      ]
    }
  ],

  "data": [
    {
      // get the documents from ElasticSearch index
      "name": "docs",
      "url": {
        %context%: true
        %timefield%: timestamp
        index: eosmon_resmon_tree-*
        body: {
          size: 10000
        },
      },
      format: { property: "hits.hits" },
      "transform": [
        {"type": "formula", "as": "date", "expr": "timeParse(datum._source.timestamp , '%Y-%m-%dT%H:%M:%SZ')"}
      ]
    },
    {
      // find the shortest path - it is the parent path of the current level
      "name": "shortest_path",
      "source": "docs",
      "transform": [
        {"type": "formula", "as": "length", "expr": "length(datum._source.path)"},
        {"type": "aggregate", "fields": ["length"], "ops": ["argmin"]}
      ]
    },
    {
      // find the last timestamp
      "name": "last_timestamp",
      "source": "docs",
      "transform": [
        {"type": "aggregate", "fields": ["date"], "ops": ["max"]}
      ]
    },
    {
      // get the documents that should be displayed on the current level and
      // transform them into a tree
      "name": "tree",
      "source": "docs",
      "transform": [
        {"type": "filter", "expr": "is_leaf == 'no' ? datum._source.parentpath == parentpath : true"},
        {"type": "filter", "expr": "dayofyear(datum.date) == last_day"},
        {"type": "fold", "fields": ["_source.maxspace"], "as":["key", "maxspace"]}, // get maxspace field to the top level. Treemap tranform can't see the nested fields after the nest transform.
        {"type": "formula", "as": "size", "expr": "logarithmic && datum.maxspace > 0 ? log(datum.maxspace) : datum.maxspace"},
        {
          "type": "nest",
          "keys": ["_source.path"]
        },
        {
          "type": "treemap",
          "field": "size",
          "round": true,
          "sort": {"field": "value", "order": "descending"},
          "method": "resquarify",
          "ratio": {"signal": "aspectRatio"},
          "size": [{"signal": "width"}, {"signal": "tree_height"}],
          "padding": 1
        }
      ]
    },
    {
      // get the documents that should be displayed
      "name": "leaves",
      "source": "tree",
      "transform": [{ "type": "filter", "expr": "!datum.children" }]
    },
    {
      // get an example document
      "name": "sample",
      "source": "leaves",
      "transform": [{ "type": "sample", "size": 1 }]
    }
  ],

  "scales": [ 
    {
      "name": "opacity",
      "type": "pow",
      "exponent": 0.3,
      "domain": {"data": "leaves", "field": "maxspace"},
      "range": [0.1, 1.0]
    },
    {
      "name": "size",
      "type": "linear",
      "domain": [0, {"signal": "width"}],
      "range": [3, 100]
    }
  ],
  
  "marks": [
    {
      "name": "button"
      "type": "rect",
      "from": {"data": "sample"}, // signal update needs to get the parentpath
      "encode": {
        "enter": {
          "fill": {"value": "white"}
          "stroke": {"value": "black"}
        },
        "update": {
          "x": {"value": 4},
          "y": {"signal": "tree_height+10"},
          "width": {"value": 60},
          "height": {"value": 30},
        }
      }
    },
    {
      "type": "text",
      "interactive": false,
      "from": {"data": "sample"}, // don't show the text if there is no data
      "encode": {
        "enter": {
          "align": {"value": "center"},
          "baseline": {"value": "middle"},
          "text": {"value": "Back"},
          "fontSize": {"value": 17},
        },
        "update": {
          "x": {"signal": "34"},
          "y": {"signal": "tree_height+26"}
        }
      }
    },
    {
      "name": "toggle"
      "type": "rect",
      "from": {"data": "sample"}, // signal update needs to get the parentpath
      "encode": {
        "enter": {
          "fill": {"value": "white"}
          "stroke": {"value": "black"}
        },
        "update": {
          "x": {"signal": "width-120"},
          "y": {"signal": "tree_height+10"},
          "width": {"value": 120},
          "height": {"value": 30},
        }
      }
    },
    {
      "type": "text",
      "interactive": false,
      "from": {"data": "sample"}, // don't show the text if there is no data
      "encode": {
        "enter": {
          "align": {"value": "center"},
          "baseline": {"value": "middle"},
          "text": {"value": "Toggle scale"},
          "fontSize": {"value": 17},
        },
        "update": {
          "x": {"signal": "width-60"},
          "y": {"signal": "tree_height+26"}
        }
      }
    },
    { 
      "name": "nodes"
      "type": "rect",
      "from": {"data": "leaves"},
      "encode": {
        "enter": {
          "fill": {"value": "orange"}
          "fillOpacity": {"scale": "opacity", "field": "maxspace"}
          "tooltip": {"signal": "datum._source.path+' ('+datum._source.usedspacestring+' / '+datum._source.maxspacestring+')'"}
        },
        "update": {
          "x": {"field": "x0"},
          "y": {"field": "y0"},
          "x2": {"field": "x1"},
          "y2": {"field": "y1"},
        }
      }
    },
    {
      "type": "text",
      "from": {"data": "leaves"},
      "interactive": false,
      "encode": {
        "enter": {
          "align": {"value": "center"}, 
          "baseline": {"value": "middle"},
        },
        "update": {
          "x": {"signal": "0.5 * (datum.x0 + datum.x1)"},
          "y": {"signal": "0.5 * (datum.y0 + datum.y1)"},
          "fontSize": {"scale": "size", "signal": "0.85*(datum.x1-datum.x0)"},
          // show dirname only if font size is readable
          "text": {"signal": "scale('size', 0.85*(datum.x1-datum.x0)) > 8 ? datum._source.dirname : ''"}
        }
      }
    },
    {
      "type": "text",
      "interactive": false,
      "encode": {
        "enter": {
          "align": {"value": "left"},
          "baseline": {"value": "middle"},
          "text": {"signal": '''
          isDefined(data('sample')[0]) ? '' : 
          ['No Data. Note to specific queries: ',
          ' ',
          'filtering specific ranges of quota parameters (usedlogicalbytes, usedfiles, maxlogicalbytes, etc.)',
          'or excluding specific values of string fields "NOT <id / id_type / statusbytes>: <value>"',
          ' ',
          'need to have the index specified explicitly to keep tree visualisation functional, e.g.:',
          ' ',
          '"NOT id_type:daemon" --> ',
          '"(_index:eosmon_resmon_quota* AND NOT id_type:project) OR _index:eosmon_resmon_tree*"'
          ]
          '''}
          "fontSize": {"value": 20},
        },
        "update": {
          "x": {"signal": "50"},
          "y": {"signal": "50"}
        }
      }
    }

@joshli is this limited to just 2.2.1? or does it occur on the latest version of OpenSearch Dashboards as well?

This happens currently in v 2.11.1 as well.