Hi, I got to thinking, maybe it would help to see this data as a bar chart with a date histogram (maybe 1 week interval), with split series. The Y-axis is the overall average of amount. Now, split the bar by terms, which can be employee name or category ID.
I have some sample data log I can use to illustrate it, where the documents have "partition", "metric" , and "success" fields. Example document:
{
"_index": "partitions",
"_type": "doc",
"_id": "xrxHg2gBmskfQiRIKwuQ",
"_version": 1,
"_score": null,
"_source": {
"@date": "2019-01-25T04:30:45Z",
"partition": "/private/var/vm",
"metric": 6852,
"success": false
},
"fields": {
"@date": [
"2019-01-25T04:30:45.000Z"
]
},
"sort": [
1548390645000
]
}
Without splitting any series, I can get an overall average of "metric" per week:
Now I can split the series on a terms aggregation and use "partition" as the field to split by. Now I have average per partition per week, for each of the top 5 partitions of each week:
I can also break it down further and aggregate by the success
true/false values. But at this point I don't want to add another aggregation that will segment these bars, because I'd end up with the same partitions showing twice in a bar. Instead, I want to split the entire chart into 2 charts and have 1 for success:true
and for
success:false`.
Here's my Data tab now:
If I change some options in "Metrics & Axes" I can make the chart type as "area", the line mode as "smooth" and the mode as "wiggle". Why all that stuff? It kind of allows me to make a chart similar to the famous "Ebb and Flow of Movies" chart: https://archive.nytimes.com/screenshots/www.nytimes.com/interactive/2008/02/23/movies/20080223_REVENUE_GRAPHIC.jpg
Now here's the chart:
I split the data up by success
which gives me 2 charts because a boolean can have one of 2 values. The top one is labeled 1: success: Descending
so that's an aggregation of the data where success:true
If I used a filters aggregation instead of a terms aggregation for success
, that aggregation in the editor would look like this:
And now my legends look like this:
If this is starting to look good, I'd urge you to keep looking at other tools in Kibana such as Visual Builder, Timelion, and Canvas: those can each do the same kinds of aggregations I've shown you but offer different options on customizing the presentation.
The idea here is to have the averages split by employee (what I did with partition
), and then the charts split by category (what I did with success
).