Pretty sure I can't do this but wanted to ask... I have data that I want to graph field x / field y rather than just graphing field x over time. Can I do this in kibana or do I have to calculate the value using a logstash filter or something?
If the values are numbers, I believe you could use a scripted field to do this. Something like this aught to work for the script:
doc['fieldA'].value / doc['fieldB'].value
You'll find scripted fields under the Indices settings, it's a tab above the field list.
EDIT: Of course, this will show the computed value over time, which now that I read your question again, doesn't sound like what you want.
The data is actually disk bytes used and in the same doc, I have the capacity and I'd like to graph the %used instead of just the raw bytes used. I'm using nagioscheckbeat to get the data to ES. And not all docs in the index have the same fields - some are just heartbeat records for example.
Over time? If so, then this should give you that value in percent minus the % symbol:
doc['bytes_used'].value / doc['total_bytes'].value * 100
Or, you can use the Percentage field formatter on that scripted field to handle both the decimal move as well as the % symbol. If you go that route, just remove the * 100 bit.
I assume you are indexing these documents as different types then. In which case, you can just filter on the _type to get at the data you need.
Let me know if I'm way off base here, but it sounds like this should give you what you want based on what I think you're asking.
thanks - lemme try... _type for the metrics data is always nagiosmetric but the individual metrics have a different "name" - the name field in this case is "disks". I assume I can work with that...
Yup, that would work too. As long as you can filter on some field value that's unique to the records you care about, you should be set.
1 Like