I added $request_time field to my Nginx access log without update the default mapping and used %{NUMBER:http.response.time:double} in Grok to parse it. I can use percentiles aggregation in DevTools on this field:
However, in bar chart visualization, I cannot use Range or Percentile in this field. I changed the aggregation to Term and figured out the Kibana see this field as String.
In addition, when I used TSVB, I still could apply Percentile on this field and now Kibana sees it as a number:
I figured out that the currently supported number types for Grok are int and float. That's why when I used %{NUMBER:http.response.time:double} to parse the field, it got some problems at some points.
I changed the pattern to %{NUMBER:http.response.time:float} and it worked fine now.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.