Group by in Kibana Lens

Elastic Stack Kibana
, ,
1

Hello! I'm looking for some info about how to aggregate some fields and make a count, then show them in a particular way. I think you'll see it better with this:

Lets say we have an index called "my_index" with documents like this:

 "_index" : "my_index",
 "_type" : "_doc",
 "_source" : {
 "date" : "2024-03-15T05:32:40.900Z",
 "top_id": "abc1234",
 "status_tracking" : [
 {
 "status" : "ok",
 "type" : "max"
 }
 ],

Now, in this code "top_id" is the identification of a robot. "type" is the type of the alarm the robot sends. Everytime the robot has any problem, it generates a new document with the type of the alarm, so every top_id has 1-50 documents associated with one of the 4 alarms types we have.

What i want is a table in my dashboard that shows the quantity of alarms of each type every top_id has. For example, the top_id = abc1234 has 23 max, 11 min, 39 mean and 13 fol (max, min, mean and fol are alarms types) Do you know how can I do it? Tysm!

2

If your possible values are controlled you can just create a table and add metrics filtering for each status_tracking.type value

I did a test as follows. First create some sample data and a dataview (next time you could provide this kind of sample data for faster resolution)

# Cleanup if necessary
DELETE discuss-357406

# Create the index with required fields
PUT discuss-357406
{
  "mappings": {
    "properties": {
      "ts": { "type": "date" },
      "top_id": { "type": "keyword" },
      "status_tracking": {
        "properties": {
          "status": { "type": "keyword" },
          "type": { "type": "keyword" }
        }
      }
    }
  }
}

# add some sample data varying the date, top_id 
# and the status_tracking.type
POST  discuss-357406/_bulk
{ "index": {}}
{"ts": "2024-04-27T18:00:00+0200", "top_id": "abc", "status_tracking": {"status": "ok", "type": "max" }}
{ "index": {}}
{"ts": "2024-04-27T18:00:00+0200", "top_id": "abc1", "status_tracking": {"status": "ok", "type": "max" }}
{ "index": {}}
{"ts": "2024-04-27T18:00:00+0200", "top_id": "abc12", "status_tracking": {"status": "ok", "type": "max" }}
{ "index": {}}
{"ts": "2024-04-27T18:00:00+0200", "top_id": "abc123", "status_tracking": {"status": "ok", "type": "max" }}
{ "index": {}}
{"ts": "2024-04-28T19:00:00+0200", "top_id": "abc", "status_tracking": {"status": "ok", "type": "min" }}
{ "index": {}}
{"ts": "2024-04-28T19:00:00+0200", "top_id": "abc1", "status_tracking": {"status": "ok", "type": "min" }}
{ "index": {}}
{"ts": "2024-04-28T19:00:00+0200", "top_id": "abc12", "status_tracking": {"status": "ok", "type": "min" }}
{ "index": {}}
{"ts": "2024-04-29T10:00:00+0200", "top_id": "abc", "status_tracking": {"status": "ok", "type": "mean" }}
{ "index": {}}
{"ts": "2024-04-29T10:00:00+0200", "top_id": "abc12", "status_tracking": {"status": "ok", "type": "mean" }}
{ "index": {}}
{"ts": "2024-04-29T10:00:00+0200", "top_id": "abc123", "status_tracking": {"status": "ok", "type": "mean" }}

# Create the data view
POST kbn:/api/data_views/data_view
{
  "data_view": {
    "title": "discuss-357406",
    "timeFieldName": "ts"
  }
}

With that data you can create a Lens table with rows per top values of the top_id field and a different metrics

image
image1273×758 70 KB

Where each metric has a custom filter

image
image1270×1167 99.4 KB