Create a new metric aggregation in Kibana

[devika_sudheer]

Hi,
I have a data consisting of timestamps and value at each timestamp. The values are both negative and positive. I want to create a line visualization in Kibana with x-axis timestamps and y-axis value with maximum deviation from 0. For example if between 3.00am and 4.00am the values are 12, -13, 3, -14 then I need the metric aggregation value to be -14. Also if the values were 12, -13, 3, 14 then I need output to be 14. The max aggregation will give me 12 in first case and min aggregation will give me -13 in second case both of which are wrong. So I would like to create a metric aggregation method of my own which can do this (language doesn't matter). Is it possible in Kibana? If so how?

[timroes]

Hi,

you could potentially write custom metrics aggregation. You can have a look at this folder: https://github.com/elastic/kibana/tree/master/src/ui/public/agg_types/metrics to see the build in metrics implementations. But be aware, that non of these would be considered public API and could change in every version and you need to update your plugin (or it might even not be compatible at all anymore). Also there is no further guidance we can give except the reference code for this.

Nevertheless you should actually be able to achieve what you want in timelion if that's an option for you. Something like the following expression should work:

.es(metric=max:value_field).if(operator=gte, if=.es(metric=min:value_field).abs(), then=.es(metric=max:value_field), else=.es(metric=min:value_field))

That will compare the max value against the absolute value of the min metrics aggregation. If the max one is larger, use it, if not, use the original min (without absolute) instead. This should result in the desired chart.

Cheers,
Tim