Datatable - two counts with different filters

Elastic Stack Kibana
1

Hi,

Let's say I have these documents:

service1 INFO "log line 1"
service1 INFO "log line 2"
service1 ERROR "error 1"
service2 INFO "log line 1"

I know how to make a table with total counts:

service count
service1 3
service2 1

I know how to make a table with just errors count:

service count
service1 1

BUT, can I make a single table somehow? Different filters for each count??

service total_count errors_count
service1 3 1
service2 1 -

Thanks!

Tal

2

Hi there, sorry but you can't do exactly what you're asking for. Could you file a feature request on the GitHub repo?

Thanks,
CJ

3

Actually after some digging I think I may have a solution for you. In the screenshot below, substitute the geo.src field for your service field and the machine.os:ios filter for status:ERROR (or something similar to filter on the error field). The second filter is blank, which will give you rows with total counts next to rows with error counts.

image
image.png1505×1221 66.3 KB

4

Thanks for the workaround! It's not as elegant as having the errors and total be in a single row, but it's something.

I will open a feature request on github. I think that what we need is to have a filter on the metrics, then I can add different filters for two count metrics.

Thanks again.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.