Calculate percentage for the fileds in time range

[ginu (GGK)]

Hi all
I am having an index which contains
@timestamp, Status, System, Subsystem...
the Status has a value like 200, 400, 500

I would like to do a calculation every 5 mins
[Sum(Status) where Status:400]/Sum(Status) *100

and build a graph based on HTTP 400 Error %

I have done the following in timelion :
(.es(index=iislogs-*, timefield=log_timestamp,q='sc_status: (400 - 410)).divide (.es(index=iislogs-*, timefield=log_timestamp,q='sc_status: (200 - 510) '))).multiply(100)

I would like to use this value in a new index or something so that I could create Alert based on the value.
How can I achieve this? in Kibana? or logstash pipeline?

Regards,
Ginu

[LizaD (Liza Dayoub)]

@mikecote can you help?

[mikecote (Mike)]

Hi @ginu,

We are currently working on a system that will let you do exactly that. At this time there isn't a solution to my knowledge but keep an eye in the coming releases for a solution. The progress will be updated at this GitHub issue https://github.com/elastic/kibana/issues/24214.

Best,
Mike.

[ginu (GGK)]

Thanks Mike
That sounds very promising. I am sure this will be a very needed feature for a lot of other customers.

But for now, do you think there is a possibility to grab this out some how or the other as a Kibana Query or somehow so that I can programmatically implement to have a solution for me now.
BR, Ginu

[mikecote (Mike)]

Hi @ginu

I believe Watcher will do what you're looking for in the meantime. You can find the documentation here: https://www.elastic.co/guide/en/kibana/7.0/watcher-getting-started.html.

Mike.

[ginu (GGK)]

Hi Mike
Thanks for the Tip and Watchers are too complicated. but i will still give it another chance.
Best Regards
Ginu

@mikecote

Mike