Counting buckets in Kibana?

Elastic Stack Kibana
1

Hey! I have a slightly odd request. Our users perform an action which creates a document in elasticsearch, called a check-in.

I want to build a boolean metric that shows whether the user has generated at least one checkin per day, over the last seven days.

Essentially, I want to search for a given document, over the last 7 days, with daily interval, and check that the count of each bucket is >=1. I can easily build a date histogram which shows that this is true, I just need to take it one step further to do a calculation over the buckets. Here is a sample response of a user for which it would be true:

 "aggregations": {
    "2": {
      "buckets": [
        {
          "key_as_string": "2018-04-03T00:00:00.000-04:00",
          "key": 1522728000000,
          "doc_count": 1
        },
        {
          "key_as_string": "2018-04-04T00:00:00.000-04:00",
          "key": 1522814400000,
          "doc_count": 1
        },
        {
          "key_as_string": "2018-04-05T00:00:00.000-04:00",
          "key": 1522900800000,
          "doc_count": 1
        },
        {
          "key_as_string": "2018-04-06T00:00:00.000-04:00",
          "key": 1522987200000,
          "doc_count": 1
        },
        {
          "key_as_string": "2018-04-07T00:00:00.000-04:00",
          "key": 1523073600000,
          "doc_count": 1
        },
        {
          "key_as_string": "2018-04-08T00:00:00.000-04:00",
          "key": 1523160000000,
          "doc_count": 1
        },
        {
          "key_as_string": "2018-04-09T00:00:00.000-04:00",
          "key": 1523246400000,
          "doc_count": 1
        },
        {
          "key_as_string": "2018-04-10T00:00:00.000-04:00",
          "key": 1523332800000,
          "doc_count": 1
        }
      ]
    }
  }

I'm just at a loss for how to set it to 'true' if all doc_counts are at least one.

2

@tadgh using the date histogram and bucketing by day will give you a visual indication of the doc counts over the last 7 days, but we don't currently have a way to provide a single indicator of pass/fail based on the criteria that you're proposed.

Have you checked out the Vega Visualizations: https://www.elastic.co/blog/custom-vega-visualizations-in-kibana you should be able to create custom visualization rather easily using Vega.

3

Awesome thanks! I'll check it out.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.