Can't get Math expression in Visual Builder to work

Hi, I'm a user of Elastic Cloud currently running 7.0.0.

I'm trying to build a pipelined visual builder timeline simular to above url but I can't get the Math expression to work.
I noticed that the tutorial mentions aggregation:Calculation using painless where my Kibana version shows aggregation:Math using tinyMath.
Both params.rate * -1 nor multiply(params.rate, -1) have any effect.

What am I missing?

{
      "title": "TUTORIAL",
      "type": "metrics",
      "params": {
        "id": "61ca57f0-469d-11e7-af02-69e470af7417",
        "type": "timeseries",
        "series": [
          {
            "id": "61ca57f1-469d-11e7-af02-69e470af7417",
            "color": "#68BC00",
            "split_mode": "terms",
            "metrics": [
              {
                "id": "61ca57f2-469d-11e7-af02-69e470af7417",
                "type": "max",
                "field": "system.network.out.bytes"
              },
              {
                "unit": "1s",
                "id": "d3598d90-773e-11e9-b715-8d4db0531556",
                "type": "derivative",
                "field": "61ca57f2-469d-11e7-af02-69e470af7417"
              },
              {
                "unit": "",
                "id": "5a525160-773f-11e9-b715-8d4db0531556",
                "type": "positive_only",
                "field": "d3598d90-773e-11e9-b715-8d4db0531556"
              },
              {
                "id": "7da8af50-7740-11e9-b715-8d4db0531556",
                "type": "series_agg",
                "function": "sum"
              }
            ],
            "separate_axis": 0,
            "axis_position": "right",
            "formatter": "bytes",
            "chart_type": "line",
            "line_width": "03",
            "point_size": "4",
            "fill": "0.1",
            "stacked": "none",
            "terms_field": "system.network.name",
            "label": "Outbound",
            "value_template": "{{value}}/s"
          },
          {
            "id": "39aed710-7741-11e9-b715-8d4db0531556",
            "color": "rgba(0,156,224,1)",
            "split_mode": "terms",
            "metrics": [
              {
                "id": "39af2530-7741-11e9-b715-8d4db0531556",
                "type": "max",
                "field": "system.network.in.bytes"
              },
              {
                "unit": "1s",
                "id": "39af2531-7741-11e9-b715-8d4db0531556",
                "type": "derivative",
                "field": "39af2530-7741-11e9-b715-8d4db0531556"
              },
              {
                "unit": "",
                "id": "39af2532-7741-11e9-b715-8d4db0531556",
                "type": "positive_only",
                "field": "39af2531-7741-11e9-b715-8d4db0531556"
              },
              {
                "script": "params.rate * -1",
                "id": "a7dc3560-780f-11e9-be38-c30d9db92957",
                "type": "math",
                "variables": [
                  {
                    "id": "aff0fec0-780f-11e9-be38-c30d9db92957",
                    "name": "rate",
                    "field": "39af2531-7741-11e9-b715-8d4db0531556"
                  }
                ]
              },
              {
                "id": "39af2533-7741-11e9-b715-8d4db0531556",
                "type": "series_agg",
                "function": "sum"
              }
            ],
            "separate_axis": 0,
            "axis_position": "right",
            "formatter": "bytes",
            "chart_type": "line",
            "line_width": "03",
            "point_size": "4",
            "fill": "0.1",
            "stacked": "none",
            "terms_field": "system.network.name",
            "label": "Inbound",
            "value_template": "{{value}}/s"
          }
        ],
        "time_field": "@timestamp",
        "index_pattern": "metricbeat*",
        "interval": ">=1m",
        "axis_position": "left",
        "axis_formatter": "number",
        "axis_scale": "normal",
        "show_legend": 1,
        "show_grid": 1,
        "default_index_pattern": "packetbeat-*"
      },
      "aggs": []
    }

@J_Weeda

Math-scripts in the Visual Builder work a little differently than I think you're approaching it.

First of, yes, you can use TinyMath in the Visual Builder. Those expressions only work as an after-the-fact evaluation on the return of the Elasticsearch-query on a per-bucket level. So not like how Painless is often used a script-fields, which is on a document-per-document basis.

In order to write a TinyMath-expression, you first need to define the variables that will be referenced. You can only use variables of aggregations you have pulled in earlier.

Below is an example

thank you for your quick reply.

Essentially I was doing the same thing but thank you for confirming. The 'rate' variable was self created in the Math aggregation and based on a previous aggregation. My example had a lot more aggregations included (following the tutorial). I should have tested a simpler scenario like you did.

As said, I had the right approach but somehow the position of the Math aggregation mattered. Below is the working variant. Before I had the Math aggregation one up (so before the Series Agg) which didn't work. At this point I do not understand why.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.