Average on Kibana Timelion with two values or parameter

I have json

{ ExchangeName:BITFINEX, CurrencyPair:ETHBTC ,MachineTime:June 5th 2017, 15:59:53.883, BidPrice:0.094 ,BidSize:22.935, AskPrice:0.094 ,AskSize:20.01, LastPrice:0.094 }

In timelion i want to find an average of (BidPrice and AskPrice).

(.es(index=ethbtc_ticker,timefield=MachineTime,split='ExchangeName:35',metric=avg:BidPrice).plus(.es(index=ethbtc_ticker,timefield=MachineTime,metric=avg:AskPrice)).label(midpoint,ExchangeName)).divide(divisor=2)

is it correct ? or any other way can we do?

Hi @shreyanshu_pare,

I'm afraid the query will probably not produce the results you expect. The reason is, that the first .es() query is split on the ExchangeName field while the second is not. I don't see a way to correctly use split .plus() at the same time here.

Instead I would suggest to create an index pattern with a scripted field that calculates the average for each document using (doc['BidPrice'].value + doc['AskPrice'].value) / 2 and visualize that in the Visualize app using the average of the scripted field as a metric aggregation (y-axis) and a date histogram and a terms filter as the bucket aggregations (x-axis).

Hi @weltenwort
if i am using split in second then it is showing Error:

Timelion: Error: in cell #1: argument must be a seriesList with a single series

if we use .add(), so is it useful ? i want in timelion.

Right, that is what I meant by

Timelion does not seem to be the right tool for this job. That is why I proposed using a scripted field in combination with Visualize.

If you're using the most recent version of Kibana you might also have success with the Time Series Visual Builder, which allows for some ad-hoc processing of the data as well.

ok ,Thanks @weltenwort , i will check.
If we use methlion in timelion so it is possible?

Mathlion is a third-party plugin and as such not officially supported by Elastic, but it might be able to achieve that.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.