Controlling graph expansion

The number of links between a node and other nodes is displayed as a glyph on the node. These links come from the relations defined in the data model, see Creating relations.

You can control the number of links indicated on a node. For example, the node for a large multinational company, such as Google, could have tens of thousands of links. The links might include connections to other companies, investors, articles that mention them, or the location of the headquarters. You could limit the relations to show the most meaningful results.

Google as a node in the graph

The number represents the number of links. This might be different to the number of nodes that appear when you add relations because some nodes might be connected by more than one link.

The Expansion tab has the following controls:

  • Refresh counts: Refreshes the counts on nodes after you make changes.

  • Available dashboards: Applies the filters from a specific dashboard to the graph. This restricts the nodes produced by an expansion to a subset of those allowed by the current filters on the dashboard. For example, select the Articles dashboard to count only the number of links to articles in your dataset. If you have filtered the Articles dashboard, then the filters are applied to the count.

  • Relations - simple: Limits the nodes produced by an expansion to the simple relations that you specify. The list of simple relations that are the relations defined in the data model.

  • Relations - aggregated: Limits the nodes produced by an expansion to the aggregated relations that you specify.

Aggregated relations

Aggregated relations are links that count the intermediate entities that are in between two entities in the data model. You can limit the nodes produced by an expansion to the aggregated relations that you specify.

They’re processed through the Elasticsearch back-end system and are well-performing. They also work well with intermediate nodes that have multi-value attributes. For example, articles can mention many companies. By activating the aggregated relation Company → Article → Company (companies mentioned in articles that mention companies) and selecting some nodes, you get a useful graph that displays companies mentioned alongside other companies within articles.

Aggregated relations aren’t counted in the glyph on a node. If you deselect all simple relations, the count on all nodes will be zero regardless of the selections you make under Relations - aggregated.

It’s often helpful to deselect all simple relations before you enable or disable aggregated relations.

Aggregated relation

Configuring aggregated relations

You can modify the following options of the aggregated relation:

Type

Terms (default) shows all terms. Significant terms removes values that are less meaningful. It excludes values that are too common in the dataset to be of interest and highlights those tied to the initial node that may be of interest to your investigation.

Size

The number of returned links by the count of the intermediate entities. Defaults to the top 10.

Metric

Count (default) returns the total number of documents that contain the term. You can select sum, min, max, or average and then select the field to aggregate on.

Invert arrow

To invert the direction of the edge, turn on the Invert arrow toggle. This visually changes the direction of the edge without changing how the aggregated relation is computed.

Creating aggregated relations

  1. Click the relations side tab and click the Relations- aggregated panel.

  2. Click Create an aggregated relation.

  3. In the Create aggregated relation window, select the path.

  4. Select the term, size, metric, and arrow direction.

  5. Click Save relation.

To edit an aggregated relation:

  • Click the Action button (…​) of the relation and select Edit.

For more information, refer to the Elasticsearch documentation about the Significant Terms aggregation.

To make the list of aggregated relations cleaner, ensure that you configure the data model to mark when fields are a unique value and when they are a single value. For more information, see Fields tab.