Combine aggregated fields on Kibana visualization


#1

Hi all,
I'm creating a line visualization in Kibana with a data histogram aggregation based on a timestamp field and I'm using a term sub-aggregation on a field called "failure" to split series. The problem is that I have some different values that imply the same type of failure like "XX8-1" and "8-1". How can I combine only these two values on a single aggregation and draw it with the other aggregations on the same visualization ?


(Marius Dragomir) #2

For what you need the Filter aggregation is the answer.

You can set a list of values a failures using the filter syntax.
This is one of my examples:
filter_agg

In your case it would be something like:
failure:XX8-1 or failure:8-1 for the first field
!failure:XX8-1 and !failure:8-1 for the second field if all the other possible values mean a different type of it.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.