# Can Kibana do this?

**URL:** <https://discuss.elastic.co/t/can-kibana-do-this/311337>\
**Category:** Kibana\
**Created:** [August 3, 2022, 7:00pm UTC](https://discuss.elastic.co/t/can-kibana-do-this/311337 "2022-08-03T19:00:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Va1-ha11a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/va1-ha11a/32/109213_2.png) [@Va1-ha11a](https://discuss.elastic.co/u/Va1-ha11a)\
**Post date:** [August 3, 2022, 7:00pm UTC](https://discuss.elastic.co/t/can-kibana-do-this/311337/1 "2022-08-03T19:00:53Z")

</div>

I'm new to Elastic and Kibana. I've been tasked with investigating Kibana as a solution for our system uptime reporting. Our Elastic 7 logs state codes for our system, where up =1, down =2 etc. every two minutes. For reporting purposes however, only every 3rd consecutive '2' counts as a true downtime. Is it possible to achieve this using aggregations/queries/KQL, or are these calculations better left for analytics applications in a data warehouse?

---

<div class="post-metadata">

**Author:** ![rudolf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rudolf/32/51200_2.png) [@rudolf](https://discuss.elastic.co/u/rudolf)\
**Post date:** [August 10, 2022, 12:14pm UTC](https://discuss.elastic.co/t/can-kibana-do-this/311337/2 "2022-08-10T12:14:26Z")

</div>

I think in most tools the best practise would be to model your data differently to make it easier to analyze.

You could use Elasticsearch transforms to transform your up/down events into an an entity-centric index [Transforming data | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html)

There's a great webinar with a practically worked out example that should point you in the right direction [https://www.elastic.co/videos/entity-centric-indexing-mark-harwood](https://www.elastic.co/videos/entity-centric-indexing-mark-harwood)

Once you have an entity centric index, Kibana would easily be able to visualize it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2022, 12:15pm UTC](https://discuss.elastic.co/t/can-kibana-do-this/311337/3 "2022-09-07T12:15:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.