Aggregat about data


(Newbie) #1

Hello,

I search to put aggregat on my data.

Here a party of my data :

TYPE	Usage
FREEUSER	345
PREMIUM_USER	8653
FREEUSER	1369
FREEUSER	87654
PREMIUM_USER	43678
FREEUSER	8654
PREMIUM_USER	2387
FREEUSER	98723
FREEUSER	45873
PREMIUM_USER	2847
PREMIUM_USER	89235
USER_UNKNOW	16235
USER_GOLD	32457

My aim is :

To sum Usage by type of client, example :

For user no gold, i want know the sum of usage :

So, USER_PREMIUM & FREEUSER, USER_UNKNOW have use a total of 405 653 octets.

Currentl, in kibana when i test this, i have the sum of usage by type of user :confused:


(Newbie) #2

I thought that in filter of logstash :

if [TYPE] == "FREEUSER or PREMIUMUSER or UNKNOW_USER" {
aggregate {
task_id => "%{taskid}"
code => "map['USAGE'] ||= 0 ; map['USAGE'] += event.get('USAGE_no_gold')"
}
}

What do you think


(Magnus Bäck) #3

In general I suggest you perform aggregations in Elasticsearch (typically via Kibana), not Logstash. The Kibana group can give suggestion for how to solve your problem.


(Newbie) #4

I have also see, we can parameter this in Kibana with devtool ?

{
"query" : {
"constant_score" : {
"filter" : {
"match" : { "TYPE" : "PREMIUMUSER, FREEUSER, UNKNOW_USER" }
}
}
},
"aggs" : {
"sum_no_gold_user" : { "sum" : { "field" : "USAGE" } }
}
}

Can you explain me the difference between solutions ?


(Newbie) #5

aha Thank you @magnusbaeck i put the question simultaneous


(Newbie) #6

@magnusbaeck Sorry but, you seem a hero of ELK Stack.

What do you think about painless scripted field ? Is deprecated no ?

I find use of DevTool more intuitive.

Here a proposed solution:
f068d89d03b54ebc23934c13529cfde7e2e4cf1b_1_678x500


(Magnus Bäck) #7

Painless was introduced in ES 5.0 and has not been deprecated.


(Newbie) #8

thank you @magnusbaeck you are amazing.

To close this topic, we must wait 1 month ?

See you soon


(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.