Hi,
I'm currently learning about query and stuffs.
In order to do so I aim to have a vega visualisation that would allow me to visualise a per process memory usage.
So far, i managed to do it using both Lens and TSVB. Unfortunately they did not met all my requierements (or at least i didn't manange to find a way to build the visualisation i wanted)
This lead to my aim to create a Vega visualisation.
I managed to get data I need but unfortunately i didn't manage to group the as i wanted.
My question is how can i group my data.
Thanks to this query :
"query": {
"exists": {
"field": "process.pid"
}
},
"fields": [
"@timestamp",
"process.pid",
"system.process.memory.rss.bytes",
"process.name",
"user.name"
],
"_source": false
I get this kind of data :
{
"took": 45,
"timed_out": false,
"_shards": {
"total": 13,
"successful": 13,
"skipped": 11,
"failed": 0
},
"hits": {
"total": 128594,
"max_score": 1,
"hits": [
{
"_index": ".ds-metricbeat-cl01ptocor00-dev-elastic_stack-2021.04.14-000001",
"_type": "_doc",
"_id": "_aUX0XgBDu3u7xL3cpWD",
"_score": 1,
"fields": {
"system.process.memory.rss.bytes": [
568008704
],
"process.name": [
"java"
],
"@timestamp": [
"2021-04-14T15:54:37.043Z"
],
"user.name": [
"elasticsearch"
],
"process.pid": [
26131
]
}
},
// Lots other hits
]
}
}
my target would be to have something like :
{
"took": 45,
"timed_out": false,
"_shards": {
"total": 13,
"successful": 13,
"skipped": 11,
"failed": 0
},
"hits": {
"total": 128594,
"max_score": 1,
"hits": [
{
"process.pid" : 26131,
"process.name": "java"
"user.name": "elasicsearch",
"memory_usage": [
{
"@timestamp" : "2021-04-14T15:54:37.043Z",
"bytes": 568008704
},
// metrics on other timestamps
]
}
// other process
]
}
}
I really do not understand how i am supposed to do so and some help would be appreciate.
Thanks by advance
Once again thanks for your help