Get unique count of most recent event

Elastic Stack Kibana
1

I have several devices, each with a unique id, where each has a field that can change value. I would like to get a count of those objects whose fields equals a particular value.

For example, the foo.bar.wifiStatus field on any number of these devices can be "online". I want to show a total count of which devices are currently that value, and when one of the device's field's changes value, the count gets decremented accordingly.

2

If I understand what you're looking for correctly, I just responded to a user with something similar.

With the Time Series Visual Builder, you can use the Filter Ratio to create a visualization to show the percentage or count of online/offline devices.

3

I want the metric to show total online devices of 1 and a total of offline devices of 2 based off the most recent timestamp. In the timeseries builder with the setting on metric, I have this data in an index called wifi_status with the filter ratio of foo.bar.wifistatus:online, the Denominator: *, Metric Aggregation:count, Grouped by: everything. I am getting a count of zero when I am expecting 1.

Example Data:
{
"foo.bar.timestamp": "2018-01-30T14:25:10",
"foo.bar.wifistatus": online,
"foo.bar.uuid": "0000-0000-0000-1000"
},
{
"foo.bar.timestamp": "2018-01-30T14:25:05",
"foo.bar.wifistatus": offline,
"foo.bar.uuid": "0000-0000-0000-1000"
},
{
"foo.bar.timestamp": "2018-01-30T14:25:00",
"foo.bar.wifistatus": online,
"foo.bar.foo.uuid": "0000-0000-0000-1000"
},
{
"foo.bar.timestamp": "2018-01-30T14:25:10",
"foo.bar.wifistatus": offline,
"foo.bar.uuid": "0000-0000-0000-2000"
},
{
"foo.bar.timestamp": "2018-01-30T14:25:05",
"foo.bar.wifistatus": online,
"foo.bar.uuid": "0000-0000-0000-2000"
},
{
"foo.bar.timestamp": "2018-01-30T14:25:10",
"foo.bar.wifistatus": offline,
"foo.bar.uuid": "0000-0000-0000-3000"
},
{
"foo.bar.timestamp": "2018-01-30T14:25:05",
"foo.bar.foo.wifistatus": online,
"foo.bar.uuid": "0000-0000-0000-3000"
}

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.