Dividing two values from same field and same index

Elastic Stack Kibana
1

Hello,

My index has a field: my_field that can have two possible values: yes and no. The following query:

{
  "size": 0,
  "aggs": {
    "count": {
      "terms": {
        "field": "my_field"
      }
    }
  }
}

returns:

{
  ...
  },
  "aggregations" : {
    "count" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "yes",
          "doc_count" : 20000
        },
        {
          "key" : "no",
          "doc_count" : 54000
        }
      ]
    }
  }
}

I would like to create a visualization in Kibana (Metric or Data Table) that would return several values:
"yes" / total which would be 20000 / 74000, so value = 0,2702
"no" / total which would be 54000 / 74000, so value = 0,7298

How could I achieve that?

2

You can do this with the TSVB visualization type. Select the "metric" tab on top, then use the "filter ratio" aggregation type. It allows you to specify a query for the numerator and denominator - in your case the numerator would be my_field:yes and the denominator *. By adding a second series, you can do the same thing for the no value (the plus button in the top right of the series panel).

3

Hello @flash1293,

That worked, thank you! Could you tell me how the same could be achieved using elasticsearch query? I'd like to get both those results in the same query call.
And also, I'd like to have a possibility of dividing those two results, so something like 0,2702 / 0,7298.
Is that possible?

4

TSVB does that in a post-processing step, not as part of the query. But you should be able do it with the bucket script aggregation: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-script-aggregation.html

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.