Got it working now with vega chart - here my code and the chart:
{
$schema: https://vega.github.io/schema/vega-lite/v2.json
title: SLA percentile evaluation
// Define the data source
data: {
url: {
%context%: true
%timefield%: @timestamp
index: logstash-xcb-db-sec-sla-performance
body: {
"aggs":{
"percent-percentiles":{
"percentiles":{
"field":"total_duration",
"percents":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99],
"keyed":false
}
}
}
// Speed up the response by only including aggregation results
size: 0
}
}
format: {property: "aggregations.percent-percentiles.values"},
},
transform: [
{
"calculate": "0.9",
"as": "sla1"
},
{
"calculate": "1.4",
"as": "sla2"
}
],
"layer": [
{
mark: bar
encoding: {
x: {
field: key
type: quantitative
axis: {title: "Percentiles", tickMinStep: 1}
},
y: {
field: value
type: quantitative
axis: {title: "Seconds"}
},
"tooltip": [
{
"field": "key",
"type": "quantitative"
},
{
"field": "value",
"type": "quantitative"
}
],
"color": {"value": "#008B8B"}
}
},
{
"mark": "rule",
"encoding": {
"y": {
"aggregate": "mean",
"field": "value",
"type": "quantitative"
},
"color": {"value": "gray"},
"size": {"value": 3},
"tooltip": [{
"aggregate": "mean",
"field": "value",
"type": "quantitative"
}]
}
},
{
"mark": "rule",
"encoding": {
"y": {
"aggregate": "mean",
"field": "sla1",
"type": "quantitative"
},
"color": {"value": "orange"},
"size": {"value": 3},
"tooltip": [{
"aggregate": "mean",
"field": "sla1",
"type": "quantitative"
}]
}
},
{
"mark": "rule",
"encoding": {
"y": {
"aggregate": "mean",
"field": "sla2",
"type": "quantitative"
},
"color": {"value": "firebrick"},
"size": {"value": 3},
"tooltip": [{
"aggregate": "mean",
"field": "sla2",
"type": "quantitative"
}]
}
}]
}
The chart:
Greetings Max