ES/Kibana query filter help - how to isolate and compare fields within fields, ordered by timestamp


(Ryan Cassano) #1

Hi all --

New to elasticsearch and kibana and struggling with filters and isolating
data with different fields.

My elasticsearch use purpose:

  • to compare different fields within the same report, OR
  • to compare different fields from two different reports (ie, similar
    metrics that came from two different systems)

Method: I am importing different system reports (raw csv) to compare in ES.

Example of my data structure and field names:

index = organizaion name
_type = site location
system = system name (field that defines where did the data come from)
report = report name (field that defines what is the name of the report)
dimension x/y = fields that define text labels for each metric (rows and
headers)
@timestamp = date

Here is a hard sample of two reports I have imported. This is obviously
only a partial listing of fields.

system: system A
report: report A
dimension x (row): job classication
dimension y (col 1): completed task count
dimension y (col 2): completed task time

system: system B
report: report A
dimension x (row): staff name
dimension y (col 1): total login time

system: system C
report: report A
dimension x (row): staff name
dimension y (col 1): hours worked

Problem 1: How do I filter by System, Report and then ask for any given
dimension?
Problem 2: What if I wanted to compare "System B > total login time" to
"System C > hours worked"?

I hope I have been clear and thanks so much for any and all feedback!

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/6fbfa8c1-cb56-43da-80aa-07c8e2a69b80%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Ryan Cassano) #2

Sorry, I meant THREE reports (not two)

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/715d0ce6-85a2-4f32-bfc3-9d27190a81ba%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(system) #3