Greetings! Apologies for the subject, I could not find a better way to summerize my question.
I'm using Kibana for analysis, and I have tried to create a visualization that shows the percentage of each HTTP method per domain, at each bucket of time.
For example, let's say in domain "a[.]com" the traffic is 80% GET method and 20% POST, and in "b[.]org" it is 50%-50% at 12:00. I would love to see it in a visualization with 2 graphs (I only have GET and POST available) - one for each method, and within each graph see the percentage of the HTTP method for that domain.
I tried to do so by using split charts to the HTTP method and then split series for domain, however unfortunately the percentage calculation is wrong, as it calculates the percentage of each method against other domains and not against the other HTTP method within the specific domain:
As you can see in this example, the pink bar has around 40% GET most of the time and 10% POST which doesn't make sense (as these are the only 2 options, other methods are not logged).
For example my current visualization can tell that
- 'a[.]com' has 25% GET, 'b[.]org' has 75% GET
- 'a[.]com' has 40% POST, 'b[.]org' has 60% GET
The total percentage of 'a[.]com' is 65% which is not what I expect, because it calculates the percentage against the other domains and not against the other methods.
This is the query I believe:
"aggs": {
"2": {
"date_histogram": {
"field": "@timestamp",
"fixed_interval": "2m",
"time_zone": "Asia/Jerusalem",
"min_doc_count": 1
},
"aggs": {
"3": {
"terms": {
"field": "http_method",
"order": {
"_count": "desc"
},
"size": 2
},
"aggs": {
"4": {
"terms": {
"field": "domain",
"order": {
"_count": "desc"
},
"size": 5
}
}
}
}
}
}
}
