Hi. I've had an ask from one of our users. We are displaying multiple metrics coming form multiple indices in the same dashboard (NOT my design, by the way).
Now, they want to have a ratio calculated for the selected time period. For example, if selecting January, they want to have the number of Service Order Errors (SOEs) that happened in January, divided by the number of Service Orders (SOs) for the same period. Both indices have the same @timestamp field, and a few filters in common, so in theory this should work okay.
But I have no idea of doing this. I have checked in TSVB (Metric + math) and in Lens, but can't figure how to use data coming from 2 different indices in a ratio. Thanks for your help!
Please share some sample documents from the indices to which you refer.
Well, if there is no timestamp or similar field I don't think Timeline can help. But you said both indices have the same @timestamp, so you do have a time series of sorts (I'm not getting into a semantic argument) ?
If you do have timestamps in both indices, then you can plot a graph of some metric (e.g. a count, a sum, ..) derived from data from index A / some other metric (e.g. a count or sum of something different) derived from the data index B.
Set the time span to what you want, and see daily/weekly/monthly/whatever.
Maybe I've misunderstood what your documents in the various indices contain, accept my apology if so.
Example, I plot ratio between number of docs (simplest example) in 2 different indices, per day, over last 30 days - should be 1.0, but ... life is not perfect.
Thread is titled "Dividing document counts from 2 different indices", so ...
.es(index=my-data1*,metric=count,timefield=timestamp).divide(.es(index=my-data2*,metric=count,timefield=timestamp)).label("Ratio of doc counts in 2 indices").yaxis(min=0.0,max=2)
Hi. Thanks for the explanations. I really need a calculated ratio (e.g. numerical metric, for example "61%") and not a time series. One of my team members suggested creating an Alias on top of both series, since they have a compatible timestamp field and primary key field. This will allow us to create a Metric using filtered data from the same Alias for numerator and denominator. We will see how it goes.
That's a very clever idea, kudos to your colleague, should indeed work well, and efficiently, in the scenario you describe.
FYI I answered a few days ago with a different join-something-across-2-indices question using ES|QL, and an enrich index, with some modification the ratio could likely be calculated too, as well as various other stats.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
