Creating a visualisation that Aggregates (combines?) 2 discrete fields in an index

We are indexing our Web Proxy logs and have a large number of usable fields...

timestamp, URL visited, bytes transferred etc...

What I'd like to do is create a visualisation that aggregates the URL's by the sum of bytes transferred...

I can get a count of of URLS i.e. 50,000 hits to; 5,000 hits to etc etc, but that doesn't show that those 5,000 hits to YouTube transferred 3x the amount of bandwidth

So what I'd like is to add-up all of the bytes transferred against {URLs} and do a top_N results against that..


URL1 --- 6,005,000 bytes
URL2 --- 4,001,000 bytes
URL3 --- 1,001,000 bytes

Solved :slight_smile:

So after playing around with the Visualization interface I was able to achieve exactly what I needed, I'll document this below in-case anyone else is trying to achieve the same results...

  • Create a new Visualization (type: TSVB)
  • Top N
  • Aggregation = Sum (on field bytes)
  • Sub Aggregation = Cumulative Sum on same field (bytes) shows up as Sum of bytes
  • Group by = Terms URL

This will then group the results by URL and provide the cumulative sum of those results :slight_smile:


1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.