ELK Kibana table grouping count

[Atif_EL_KHACHINE]

Hi,
I have some data :

{"groupname":"ZAAH", "dname":"DEVICE1", "status":"OK"}

{"groupname":"ZAAH","dname":"DEVICE2", "status":"ERROR"}

{"groupname":"ZAAH","dname":"DEVICE3", "status":"OK"}
{"groupname":"ZAAH","dname":"DEVICE3", "status":"ERROR"}

{"groupname":"ZAAH","dname":"DEVICE4", "status":"ERROR"}
{"groupname":"ZAAH","dname":"DEVICE4", "status":"OK"}

How can i do with lets say Kibana table to get this result (status OK is higher than ERROR, so if a device send 2 status OK and ERROR / or ERROR and OK, we consider the device is OK) :

groupname status count
ZAAH OK 3 (because device1 is OK + device3 is OK + device4 is OK)
ZAAH ERROR 1 (because device2 is ERROR)

Any hints are welcome.

[wylie (Wylie Conlon)]

Hi, welcome! Not all of the parts of your question are directly supported by Kibana. Kibana is able to show you a table based on the Terms aggregation, so you could for example show the count for each (groupname, dname, status) tuple in alphabetical order- but without extra processing. Would that work?

If that doesn't work, then I think you have two options:

1. Change the data format, for example by using the Transform API which is often used in this type of data
2. Switch to a different visualization type, specifically Vega, which is more powerful- but doesn't do great tables

[Atif_EL_KHACHINE]

Hi, thank you for your feedback. I have never used Vega or tansform api. Do you know how can i accomplish the task with Vega ? or easier with Transform api ?

Thank you again

[wylie (Wylie Conlon)]

Both options I recommended will require some work to set up correctly- if you require a table, then you can't use Vega. My personal preference is Vega: it's very powerful once you learn it.