How to calculate combinating different index with different mapping in order to show a histogram in Kibana

Elastic Stack Kibana
1

Hi,

I have a question about Kibana and how to do calculates combinating different index with different mapping.

I want to create a graphic using TSVB or just a line chart that calculates a "Rate", but the problem is i need to use the count about two different index with different mapping.

The index 1 is a list of incidents with some fields (company, date, info about incidents, etc) and the index 2 is a list of installed base with differents fields (company, date, another info).

The Rate is just : count(incidents) / count (installed base) grouped by month in order to get a line char that shows the rate for each month in all year (January: 10%, Feb: 13%...)

So, i tried to use TSVB, and i can got both counts separated in the same graphic and grouped by months, but i can't combine them in an aggregation with Math function to calculate this Rate.

Besides, i though about create an script field, but, if im right, TSVB can`t use it.
On the other hand, char line visualization allows to use script field but not combine index pattern (if im right again)

So, how could i make this and similar calculates using combine index patterns?

I hope i have explained this as best i can.
Thanks for the help!

2

Hello @Juanjo_Herrero_Berme

I think the only way to compute a ratio easily from different indices would be using Timelion or Vega.
It is also possible with TSVB but it depends on how data is structured.

Would you mind sharing a screenshot of the data & panel options?

I think to search on multiple indices you can use an index pattern such as indexOne,indexTwo.

Have you tried with Filter Ratio aggregation?

3

Hi Luca!

Thanks you very much for your help, it was really useful.

I tried all the possibilites that you suggested and finally i got it.
I think that TimeLion is the right way in order to make graphs or histogram with different index and with different mapping.

On the other hand, TSVB Ratio Filter allows it too, the only problem is that the index pattern must combine both index with different mapping, i mean, if you have a index called "index_mapping_1" and a index called "index_mapping_2", you must create a index pattern called "index_mapping*" or similar that includes both index names (its mapping will combine both index mapping"

I hope this can be useful for others.

See you!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.