How to calculate and visualize the number of solved issues

Elastic Stack Kibana
1

Hi,

I have a field in my logfile that is called "last_seen_time". This field gets populated with a timestamp that describes when a problem was last seen. Once a problem is not seen for two months anymore we consider the problem solved.

How can I best visualize the number of solved issues over time in Kibana in this configuration (only solved if not seen anymore since "that date on the axis - 2 month"?
I want to visualize number of solved issues on y axis, time on x axis.

If possible it would also be nice to express this not in absolute numbers (number of solved issues) but % wise to the total number of issues in the index.

How can I best do this? Timelion? Anything else? What formulla to use in timelion

2

Hi @anchasis,

this does not sound like something that would be easy to solve in Kibana. But maybe we can work something out if you tell me a bit more about your schema:

  • is there a document for each class of issues or for each occurence of an issue
  • how does last_seen_time differ from the primary timestamp field of the document (if there is one)
  • how are the classes of issues identified (some kind of keyword?)
3
  • There is a document for each occurence of an issue
  • last_seen_time is the time of the last vulnerability scan where the issue was identified, not the time the logline was imported in ELK
  • classes are CVE with an id and description + extra info
4

I can't think of a way to achieve that without pre-processing your data. I would recommend to use something like logstash or a custom script to regularly post documents to a separate index that contains the summary of the status you want to visualize. For example you could post a document like

{
  "@timestamp": "1516031776000",
  "open_issues": [
    "CVE-1",
    "CVE-3"
  ],
  "closed_issues": [
    "CVE-2"
  ]
}

every day and easily visualize them using normal Date Histogram, Terms, Filters and Cardinality aggregations.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.