Can you have a data table visualization using computed metric?

Elastic Stack Kibana
1

I have a bunch of data representing individual runs of jobs in a cluster. There are a couple thousand unique kinds of jobs, and so one of the fields in each entry is the job's name. Other fields include duration, success/failure/other, and some various other fields.

I'd like to find the Top N jobs by failure rate. I've created a Data Table, and added a bucket using "Terms" aggregation on the Name field. For the metric I've chosen count. This gives me the Top N jobs by number of times they were run.

First question: Is it possible to add new metrics where the column counts only those values that match a specific condition? For example, maybe a job is run 1000 times, it fails 10 times and succeeds 990 times. I'd like columns "Success", "Fail", and "Count" with values 990, 10, and 1000 respectively. Currently I can only figure out how to get the 1000.

Second question: Is it possible to add a metric that is calculated as Fail / Count, and have the Data Table contain only the Top N jobs according to Fail / Count?

2

Hi @RandomTruffle!

Regarding your first question:
I think that, in addition to the terms aggregation, you need to add an additional break down, using the filters aggregation. Unfortunately, it breaks them down in rows, not columns (that's not currently supported in Kibana)

To your second question, I think you need a scripted field for that: depending on the version you're running you can use the new Runtime fields or Kibana scripted fields. The script can return 1 or 0 depending on whether it's Failed or not. Then, a simple aggregate on that field will return the field.

Alternatively, you can use a bucket-script aggregation + Vega.

For the future, I know there are some efforts in Kibana to run operations based on the fields printed on a table. You can follow that issue to know more.

EDIT: You can also use TSVB special aggregation "Math". It allows you to print scripted values from previous aggregations.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.