Can't figure out how to create time based visualisation with sub-aggregation

Elastic Stack Kibana
1

Hello.

I'm collecting accounting data from our cloud platform (vmname, memory, cpu, owner, etc...)
Script is running every hour and posting document for every vm.
I would like to visualize usage of resources by every owner in time.
So I need first to aggregate by vmname and take average of cpu then take sum of those averages by time histogram and split it by owner.
Is it possible to make in kibana? What kind of visualisation should it take? I'm using 7.6.1

2

Welcome to our community! :smiley:
As an FYI, 7.6 is EOL so it'd be recommended to upgrade.

You will want to create an average metric on the CPU field, then do a terms aggregation by vmname and terms sub-aggregation by owner. And use a date histogram to plot over time.

If you upgrade, Lens makes this super simple;
Screen Shot 2021-10-01 at 10.02.49

3

I would like to say, that it was super easy barely an inconvenience, but even after upgrade I can't get how to make sub-aggregation in lense.

4

It is not possible yet to have a multi split/break down by terms/Top values in Lens.

But in visualize, I managed to achieve this with 2 Split series + 1 X Axis Date Histogram.
In my example I've taken the AVG of memory, then split by geo.src and a sub aggregation split (note the order) by ip plotted on a Date Histogram on the X-Axis:

Screenshot 2021-10-01 at 11.35.14
Screenshot 2021-10-01 at 11.35.142834×1572 185 KB

Is this what you are looking for?

5

not sure.
I need to sum of all the of averages by vm.
So first step is to get average metric (cpucount) for each vm then sum all of them aggregating by owner.
Is it possible in kibana?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.