How to calculate & draw metrics of scripted metrics

Elastic Stack Kibana
2

If you have the privileges to create a transform, then the elastic painless example Getting duration by using bucket script can do exactly what you want. It creates a new index where all documents are grouped according to your needs.

To create the transform:

  1. go to Stack Management > Transforms > + Create a transform
  2. select Edit JSON config for the Pivot configuration object
  3. paste & apply the JSON below
  4. check whether the result is the expected in the Transform preview
  5. fill out the rest of the transform details + save the transform

JSON config

{
  "group_by": {
	"DeviceID": {
	  "terms": {
		"field": "DeviceID.keyword"
	  }
	},
	"FileType": {
	  "terms": {
		"field": "FileType.keyword"
	  }
	},
	"FileTimestamp": {
	  "terms": {
		"field": "FileTimestamp"
	  }
	}
  },
  "aggregations": {
	"TimeStampStats": {
	  "stats": {
		"field": "@timestamp"
	  }
	},
	"TimeSpan": {
	  "bucket_script": {
		"buckets_path": {
		  "first": "TimeStampStats.min",
		  "last": "TimeStampStats.max"
		},
		"script": "params.last - params.first"
	  }
	}
  }
}

Now you can create a chart from the new index, for example with these settings:

  • Vertical Bars
  • Metrics:
    • Y-axis = "Count"
  • Buckets:
    • X-axis = "TimeSpan"
    • Split series = "FileType"