Help Required with query

Elastic Stack Elasticsearch
1

We have our logs in Elasticsearch which are normalized. Here is what we store in nginx logs.

“_source”: {
“remote”: “influx-dev-cluster01”,
“host”: “10.88.14.126”,
“ident”: “-”,
“user”: “user”,
“method”: “POST”,
“path”: “/query?db=&q”,
“code”: “200”,
“size”: “236”,
“referer”: “-”,
“agent”: “DBClient”,
“upstream_latency”: “0.002”,
“latency”: “0.000”,
“hostname”: “ssd02”,
“component”: ““influxdb””,
“@timestamp”: “2019 Jan 11 12:40:59”,
“tag”: “nginx”
}

I want to visualize availability. Definition of availability is

Availability % = ( Successful Requests * 100 ) / ( Success Requests + Failed Requests )

Where Successful requests.= requests with response code < 500 and
Failed Requests = requests with response code >= 500

Can some one help me or guide with writing query to calculate the approach. We want to visualize this with grafana

2

Any help here greatly appreciated

3

I would recommend you have a look at pipeline aggregations, as I believe that may be the best fit. Not sure if or how these can be used with Grafana though.

4

Thanks a lot Christian . I will give a try

5

I have given a try.
GET /myindex*/_search
{
"size": 0,
"aggs": {
"events": {
"date_histogram": {
"field": "@timestamp",
"interval": "hour",
"format": "yyyy-MM-dd-HH:mm",
"min_doc_count": 0
},
"aggs": {
"total_hits": {
"range": {
"field": "code",
"keyed": true,
"ranges": [
{
"key": "success",
"from": 0,
"to": 500
},
{
"key": "failures",
"from": 500,
"to": 1000
}
]
}
}
}
}
}
}

I am not able to compute the availabiliity formula as mentioned above. tried pipeline aggregations still not able to get my head around. Can you suggest how to calculate the %

6

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-script-aggregation.html