Calculate percentage for the fileds in time range

Hi all
I am having an index which contains
@timestamp, Status, System, Subsystem...
the Status has a value like 200, 400, 500

I would like to do a calculation every 5 mins
[Sum(Status) where Status:400]/Sum(Status) *100

and build a graph based on HTTP 400 Error %

I have done the following in timelion :
(.es(index=iislogs-*, timefield=log_timestamp,q='sc_status: (400 - 410)).divide (.es(index=iislogs-*, timefield=log_timestamp,q='sc_status: (200 - 510) '))).multiply(100)

I would like to use this value in a new index or something so that I could create Alert based on the value.
How can I achieve this? in Kibana? or logstash pipeline?


@mikecote can you help?

Hi @ginu,

We are currently working on a system that will let you do exactly that. At this time there isn't a solution to my knowledge but keep an eye in the coming releases for a solution. The progress will be updated at this GitHub issue


Thanks Mike
That sounds very promising. I am sure this will be a very needed feature for a lot of other customers.

But for now, do you think there is a possibility to grab this out some how or the other as a Kibana Query or somehow so that I can programmatically implement to have a solution for me now.
BR, Ginu

Hi @ginu

I believe Watcher will do what you're looking for in the meantime. You can find the documentation here:


Hi Mike
Thanks for the Tip and Watchers are too complicated. but i will still give it another chance.
Best Regards

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.