Count number of occurences based on a condition

[javidr (javi)]

Hi

Im having some issues with Kibana, as it doesnt work well with nested data (it is, a json inside the main json)

To solve it, i have had to flatten it, so, for example

{"car": "Ford, "Model": "Mondeo", "details": [ { "Price:, "6000", "Condition": "Used" }, {"Price:, "9000", "Condition": "New" }, { "Price:, "8000", "Condition": "New" } ]}

Converts to:

{"car": "Ford, "Model": "Mondeo", "details.Price_0:, "6000", "details_Condition_0": "Used", "details.Price_1": "9000"......}

I would like to visualise in a bar chart the number of new cars per model.

The X axis will be model, but for the Y axis i would need to display the number of times that detail_condition_* equals to "New"

How can i visualise that? Im trying to generate a query but it doesnt seem to work

Thanks

[bhavyarm]

Hi Javi,

We can try something here and see if it doesn't work.

Can you create your chart on with y axis on count and x-axis mode.
And then try to create a filter on visualization by using add filter button.

In the example below - I am creating a filter for "win 8"

Thanks
Bhavya

[javidr (javi)]

Hi

Thanks for the answer

The problem I face is that my filter is not based on a field only, as it is an array flattened and every occurrence has a different name. details_condition_1, details_condition_2 etc...

It needs to be details_condition_$ what I use for filtering where $ is a wildcard

Can I create a regex or similar to match it?

[LeeDr (Lee Drengenberg)]

How are you loading this data and how did you flatten the data?

Ideally you would want each doc to represent 1 vehicle like;

{"car": "Ford, "Model": "Mondeo", "Price:, "6000", "Condition": "Used" }

{"car": "Ford, "Model": "Mondeo", "Price:, "9000", "Condition": "New" }

{"car": "Ford, "Model": "Mondeo", "Price:, "8000", "Condition": "New" }

If that is possible it would make things really easy.