How can kibana compare two fields?

Elastic Stack Kibana
5

Hi @rodri.gz

If you want to operate with aggregations Lens formula are probably a better option than runtime fields.
The only limitation I see is that Lens formulas currently do not support conditional operations.

As for the greater than operation, have some strong assumptions as all numbers involved are integers, you may approximate the gt operation with some equation: it will be very verbose but doable.
The linked equation returns 0 if x < k, but returns x otherwise.

Here I am replicating the linked equation in Lens formula with the bytes (the k) and machine.ram (the x) fields:

(sum(machine.ram)/2) * 
( 
    (sum(machine.ram) - sum(bytes) ) / 
    clamp(
      abs(sum(machine.ram) - sum(bytes))
      , 0.0001
      , sum(machine.ram) + sum(bytes)
    ) + 1
)
/ sum(machine.ram)

If you have noted there are 2 small differences from the linked equation in this formula:

  • clamp( ..., 0.0001, sum(machine.ram) + sum(bytes)) this is due to the case where the two sum aggregations are the same number, so I'm limiting the abs result to be within 0.0001 and a high value - I've taken sum(machine.ram) + sum(bytes) as higher extreme - it cannot be higher than the sum of both
  • / sum(machine.ram) at the end divides result in case sum(machine.ram) is higher than sum(bytes) - the case where x in returned in the original formula.

This formula should return:

  • 0 if sum(machine.ram) <= sum(bytes)
  • 1 if sum(machine.ram) > sum(bytes)
1 Like