Get times where document count = 0

Elastic Stack Elasticsearch
1

Hi,

We have a problem, that a part of our application stalls from time to time.
This results in no log lines. Normally we have multiple entries per second. When it stalls there are none.

Log lines are already indexed in elasticsearch.
Now I need to query the times, where no loglines are present.

example:
Our data looks like this:

grafik
grafik.png1088×250 12.4 KB

I would like to run a query like this:

  • give me all time buckets (bucket size = 1s), where the count is 0.

Can I do this via kibana or elasticsearch?
I could use the count api and query each second, but I think there should be a better approach.

Thanks, Andreas

2

I need a post processing method. Initiating a 1s metric during logstash parsing should be avoided.

3

found out that adding

{"min_doc_count": 0}

does display the timestamps where the document count is 0. Unfortunately there is no flag like "max_doc_count"

So is there a way to filter the result in elasticsearch or kibana?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.