Can't get Math expression in Visual Builder to work

[J_Weeda (J)]

Hi, I'm a user of Elastic Cloud currently running 7.0.0.

I'm trying to build a pipelined visual builder timeline simular to above url but I can't get the Math expression to work.
I noticed that the tutorial mentions aggregation:Calculation using painless where my Kibana version shows aggregation:Math using tinyMath.
Both params.rate * -1 nor multiply(params.rate, -1) have any effect.

What am I missing?

{
      "title": "TUTORIAL",
      "type": "metrics",
      "params": {
        "id": "61ca57f0-469d-11e7-af02-69e470af7417",
        "type": "timeseries",
        "series": [
          {
            "id": "61ca57f1-469d-11e7-af02-69e470af7417",
            "color": "#68BC00",
            "split_mode": "terms",
            "metrics": [
              {
                "id": "61ca57f2-469d-11e7-af02-69e470af7417",
                "type": "max",
                "field": "system.network.out.bytes"
              },
              {
                "unit": "1s",
                "id": "d3598d90-773e-11e9-b715-8d4db0531556",
                "type": "derivative",
                "field": "61ca57f2-469d-11e7-af02-69e470af7417"
              },
              {
                "unit": "",
                "id": "5a525160-773f-11e9-b715-8d4db0531556",
                "type": "positive_only",
                "field": "d3598d90-773e-11e9-b715-8d4db0531556"
              },
              {
                "id": "7da8af50-7740-11e9-b715-8d4db0531556",
                "type": "series_agg",
                "function": "sum"
              }
            ],
            "separate_axis": 0,
            "axis_position": "right",
            "formatter": "bytes",
            "chart_type": "line",
            "line_width": "03",
            "point_size": "4",
            "fill": "0.1",
            "stacked": "none",
            "terms_field": "system.network.name",
            "label": "Outbound",
            "value_template": "{{value}}/s"
          },
          {
            "id": "39aed710-7741-11e9-b715-8d4db0531556",
            "color": "rgba(0,156,224,1)",
            "split_mode": "terms",
            "metrics": [
              {
                "id": "39af2530-7741-11e9-b715-8d4db0531556",
                "type": "max",
                "field": "system.network.in.bytes"
              },
              {
                "unit": "1s",
                "id": "39af2531-7741-11e9-b715-8d4db0531556",
                "type": "derivative",
                "field": "39af2530-7741-11e9-b715-8d4db0531556"
              },
              {
                "unit": "",
                "id": "39af2532-7741-11e9-b715-8d4db0531556",
                "type": "positive_only",
                "field": "39af2531-7741-11e9-b715-8d4db0531556"
              },
              {
                "script": "params.rate * -1",
                "id": "a7dc3560-780f-11e9-be38-c30d9db92957",
                "type": "math",
                "variables": [
                  {
                    "id": "aff0fec0-780f-11e9-be38-c30d9db92957",
                    "name": "rate",
                    "field": "39af2531-7741-11e9-b715-8d4db0531556"
                  }
                ]
              },
              {
                "id": "39af2533-7741-11e9-b715-8d4db0531556",
                "type": "series_agg",
                "function": "sum"
              }
            ],
            "separate_axis": 0,
            "axis_position": "right",
            "formatter": "bytes",
            "chart_type": "line",
            "line_width": "03",
            "point_size": "4",
            "fill": "0.1",
            "stacked": "none",
            "terms_field": "system.network.name",
            "label": "Inbound",
            "value_template": "{{value}}/s"
          }
        ],
        "time_field": "@timestamp",
        "index_pattern": "metricbeat*",
        "interval": ">=1m",
        "axis_position": "left",
        "axis_formatter": "number",
        "axis_scale": "normal",
        "show_legend": 1,
        "show_grid": 1,
        "default_index_pattern": "packetbeat-*"
      },
      "aggs": []
    }

[thomasneirynck]

@J_Weeda

Math-scripts in the Visual Builder work a little differently than I think you're approaching it.

First of, yes, you can use TinyMath in the Visual Builder. Those expressions only work as an after-the-fact evaluation on the return of the Elasticsearch-query on a per-bucket level. So not like how Painless is often used a script-fields, which is on a document-per-document basis.

In order to write a TinyMath-expression, you first need to define the variables that will be referenced. You can only use variables of aggregations you have pulled in earlier.

Below is an example

[J_Weeda (J)]

thank you for your quick reply.

Essentially I was doing the same thing but thank you for confirming. The 'rate' variable was self created in the Math aggregation and based on a previous aggregation. My example had a lot more aggregations included (following the tutorial). I should have tested a simpler scenario like you did.

As said, I had the right approach but somehow the position of the Math aggregation mattered. Below is the working variant. Before I had the Math aggregation one up (so before the Series Agg) which didn't work. At this point I do not understand why.