Best practice to aggregate by issue status

[lizozom (Liza Katz)]

I have an index that stores logs of issue status changes (imaging something like GH issues). An issue can be either open or closed.

I want to show a metric of how many issues are currently open or closed.

What would be the appropriate way to create such a visualization?

i.e. within the given time frame:

• 20 issues were closed
• 10 issues remain open

Thank you

[Priscilla_Parodi]

Hello @lizozom,

A metric visualization would be good.

Example (in this case 200, 404, 503), count aggregation.

Then you can add a filter specifically for open or closed.

Example: status.keyword : "open"

[lizozom (Liza Katz)]

Let me clarify my use case:

When the issue is opened, a log is added saying issue #1234 is opened on the 01-01-2024 08:00:00.
Then when the issue is closed, a log is added, saying issue #1234 is closed on the 01-01-2024 10:00:00.

If I use a simple metric visualization, I would get +1 on the open AND on the closed counters. I want the issue to be either open OR closed, so that it's not counted twice.

I used a Transform to aggregate the data by issue ID, but I was wondering if there was a more convenient way of doing this.

[Marco_Liberati]

Hi @lizozom ,

the only alternative to the Transform approach I can think of is building 2 distinct metric visualisations with raw documents:

• first one for the Still open issues will have the count(kql='status.keyword: "open"') - count(kql='status.keyword: "closed"') formula
• second one for the Closed ones will have a count with the 'status.keyword: "closed"' filter on it.

[lizozom (Liza Katz)]

The Transform approach sounds good then!
Good they were added.

Thanks!