Divide two columns(generated from aggregations) in data table

Elastic Stack Kibana
1

I am very new to Elastic stack, so apologies upfront, if I am missing the obvious. Let me start by explaining my use case. All documents in my index has field _idVal(represents a session). Sessions will have different processes starting and exiting represented by _processName. I have another field _badExit, which represents a crash. The same process could crash more than once for the same _idVal. I want to display the cardinality of sessions(_idVal), total _badExit counts, and sessionsWithCrash(cardinality of sessions with _badExits) grouped by _processName. I am able to use metric aggregation to achieve this. Where I am stuck is while trying to display the ratio of sessionsWithCrash and totalSessions. I tried using Math aggregation in visual builder but it doesn't allow filtering for sub-metric(required for filtering badExit).

2

Hi, welcome to the forums! I think you have two options that make sense to me. TSVB supports a filter ratio function which is able to do this, explained in more detail in this blog post. Another pretty common thing is to use the transforms feature to let you do a second level of aggregation.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.