How can I build verticalBar chart based on some custom calculation

Elastic Stack Kibana
1

Hi,
I have created a VerticalBar chart in Kibana. I used the Metrics and Buckets option to choose the index and terms.

Screen Shot 2021-06-24 at 9.57.37 AM
Screen Shot 2021-06-24 at 9.57.37 AM1180×644 14.6 KB

Say,

totalValue is an index with values [available/offline/suspended]
errorValue is an index with values [401/403/500]

I want my bars to be calculated on certain formula.
e.g.
((total available count of totalValue) - (total 401 count of errorValue) - (total 500 count of errorValue)) / ((total available count of totalValue) - (total 401 count of errorValue)) * 100

Is it possible to build in kibana?

Thank you.

2

You can do this using a TSVB vertical bar chart with a Filter Ratio.

To use Lens, you can use two filters aggregations like in this tutorial. In the Vertical Bar chart you're using, you would also have to use 2 filter buckets.

We have also nearly finished work on a Lens Formula feature that will solve this problem, it might be released in Kibana, 7.14 or 7.15 depending on how testing goes.

3

Thanks Wylie.

I am going with the TSVB option by following the initial steps mentioned in Filter ratio in TSVB.

I am trying to perform a sum operation on one of the fields but I do not see that field as an option. I used python to create mapping and later dumping the data using the API.

 "mappings": {
            "properties": {
                "timestamp": {
                    "type": "date"
                },
                "status": {
                    "type": "text",
                    "fields": {
                        "raw": {
                            "type": "keyword"
                        }
                    }
                },
                "service": {
                    "type": "text",
                    "fields": {
                        "raw": {
                            "type": "keyword"
                        }
                    }
                }
            }
        }

I can only see epoch_time in the dropdown. Is it because that's the only integer field? How would I make a sum aggregation on a string field like 'service'. Is my mapping correct?

Screen Shot 2021-06-25 at 4.05.15 PM
Screen Shot 2021-06-25 at 4.05.15 PM1856×367 25.2 KB

4

Hi,
I added a scripted field as integer which I can see in discovery tab.
Now when I goto visualization -> TSVB and select my index, under data -> Aggregation-> Sum , I don't see the scripted field option there. I want to add a sum field on scripted field and do a bucket aggregation to find the percentage.
How can I get the scripted field there?

5

TSVB does not allow you to take the sum of a scripted field, although you can use these scripted fields with KQL. Starting in 7.13.0 TSVB does support ES runtime fields and Kibana runtime fields.