I want to make a Timelion chart, where only those datapoints are shown that fit a condition. For example I want to count the number of GET requests which resulted in 404 responses over time. Is it possible to do this in timelion?
The following was my attempt:
.es(q='method.keyword:GET').if(eq,400,.es(q='responseStatus'))
this should almost work 
.es(*).if(lt, 20, 0) will show a chart with only points where the value is above 20 ...
you could also show a different metric that you used for the if condition ...
.es(*).if(lt, 20, 0, .es(metric=avg:bytes)) will show avg:bytes for the datapoints where count is more than 20
you could also do a different query as you do in your example, but that might produce weird results
as your first query might return completely different set of points as the second one ...
Thanks, but I think I did not phrase my question well, or my example was misleading.
So I have a big chunk of data (all that is counted in .es(*)), but first of all I only want to use a part of it (the instances where there is a call to the relevant part of the page). I want to filter these calls based on method, so I only get the PUT request for example, and then filter that once again for response (404). So my condition is not on the count of the calls, but their nature, if you can call it that.
EDIT: In the meantime I think I found the answer to my question: I wanted this: .es(q='method.keyword:GET && responseStatus:400')
unfortunately i think that is not possible, .es will always return a metric (like a count, average, sum) and not the actual field values (like 404, 200, 500 ... or PUT/GET)
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.