Can't figure out how to create time based visualisation with sub-aggregation

[Sergey_Ganchuk]

Hello.

I'm collecting accounting data from our cloud platform (vmname, memory, cpu, owner, etc...)
Script is running every hour and posting document for every vm.
I would like to visualize usage of resources by every owner in time.
So I need first to aggregate by vmname and take average of cpu then take sum of those averages by time histogram and split it by owner.
Is it possible to make in kibana? What kind of visualisation should it take? I'm using 7.6.1

[warkolm (Mark Walkom)]

Welcome to our community!
As an FYI, 7.6 is EOL so it'd be recommended to upgrade.

@Sergey_Ganchuk

So I need first to aggregate by vmname and take average of cpu then take sum of those averages by time histogram and split it by owner.

You will want to create an average metric on the CPU field, then do a terms aggregation by vmname and terms sub-aggregation by owner. And use a date histogram to plot over time.

If you upgrade, Lens makes this super simple;

[Sergey_Ganchuk]

I would like to say, that it was super easy barely an inconvenience, but even after upgrade I can't get how to make sub-aggregation in lense.

[Marco_Liberati]

It is not possible yet to have a multi split/break down by terms/Top values in Lens.

But in visualize, I managed to achieve this with 2 Split series + 1 X Axis Date Histogram.
In my example I've taken the AVG of memory, then split by geo.src and a sub aggregation split (note the order) by ip plotted on a Date Histogram on the X-Axis:

Is this what you are looking for?

[Sergey_Ganchuk]

not sure.
I need to sum of all the of averages by vm.
So first step is to get average metric (cpucount) for each vm then sum all of them aggregating by owner.
Is it possible in kibana?