Graph calculated value


(Jerry Hoffmeister) #1

Pretty sure I can't do this but wanted to ask... I have data that I want to graph field x / field y rather than just graphing field x over time. Can I do this in kibana or do I have to calculate the value using a logstash filter or something?


(Joe Fleming) #2

If the values are numbers, I believe you could use a scripted field to do this. Something like this aught to work for the script:

doc['fieldA'].value / doc['fieldB'].value

You'll find scripted fields under the Indices settings, it's a tab above the field list.

EDIT: Of course, this will show the computed value over time, which now that I read your question again, doesn't sound like what you want.


(Jerry Hoffmeister) #3

The data is actually disk bytes used and in the same doc, I have the capacity and I'd like to graph the %used instead of just the raw bytes used. I'm using nagioscheckbeat to get the data to ES. And not all docs in the index have the same fields - some are just heartbeat records for example.


(Joe Fleming) #4

Over time? If so, then this should give you that value in percent minus the % symbol:

doc['bytes_used'].value / doc['total_bytes'].value * 100

Or, you can use the Percentage field formatter on that scripted field to handle both the decimal move as well as the % symbol. If you go that route, just remove the * 100 bit.

I assume you are indexing these documents as different types then. In which case, you can just filter on the _type to get at the data you need.

Let me know if I'm way off base here, but it sounds like this should give you what you want based on what I think you're asking.


(Jerry Hoffmeister) #5

thanks - lemme try... _type for the metrics data is always nagiosmetric but the individual metrics have a different "name" - the name field in this case is "disks". I assume I can work with that...


(Joe Fleming) #6

Yup, that would work too. As long as you can filter on some field value that's unique to the records you care about, you should be set.


(system) #7