Get the maximum and average values after Count

peropero · August 26, 2019, 12:16pm

The following log is output.

@timestamp status_code
2019/08/25 20:00 200
2019/08/25 20:00 200
2019/08/25 20:00 200
2019/08/25 20:01 300
2019/08/25 20:02 400
・
・
・
08/26/2019 02:02 400

What I want to express in Kibana visualization is the maximum and average values of TPS.
It was possible to express TPS by counting each status_code.

However, the maximum and average values per hour or day of this TPS cannot be expressed.

Is there any good way?

markov00 · August 26, 2019, 12:49pm

Hi,
you can use Average aggregation on one series, and create another series (with the + button on the top right side of each series) with Max aggregation.
Each of them should have the group by terms : status_code as you already did.
The only thing is to change the interval value to hours that will allow you to create one bucket per hour and the aggregation will be computed on that interval

peropero · August 27, 2019, 12:35am

Hi,
Can you tell me specifically with screenshots?

I'm sorry for the lack of information.
Added screenshot above.
In the first place, the expression of TPS is
In panel options tab, set interval: 1m,
The value counted in the Data tab is divided by 60.
Using the value obtained by this,
I want to express the maximum value every hour in the past 24 hours.
I also want to express the average value every hour in 24 hours.

Or is it better to output this TPS as a table?
Could you tell me the procedure in that case?

peropero · August 28, 2019, 3:13am

Hi, @markov00

I tried it, but I feel something is different.
I changed the interval to 1h and divided by 3600.
Also, max and avg are grouped by “terms: status_code” respectively, but the result is as attached.