How to compare and sum docs with different values

Elastic Stack Kibana
1

Hello,

I have docs with such data:
sessionState: Active
statusBoolean: true
statusInt:-1
timeStamp:Aug 26, 2020 @ 02:08:21.522

OR

sessionState: Disconnected
statusBoolean: false
statusInt:1
timeStamp:Aug 26, 2020 @ 02:09:21.522

on time line I can see when status from Active became to Disconnected or from Disc to Act.
But I need to SUM how many user became from Active to Disconnected during some time period.

Maybe I need to do some script field for this, that will compare privies value and if it different mark this and after that sum this marks.

Can you please help me with this?
Thank you.

2

Hello @Den

I'd recommend changing the way the data is stored. The query is simple if both events are stored in a single document -

sessionid
activeTimestamp
disconnectedTimestamp

3

Sorry, I probably put the question incorrectly.

Wa09eJ5dxh
Wa09eJ5dxh1850×696 76.4 KB

Every minute I receive information from script. Information looks like
Username:
sessionState:
statusBoolean:
statusInt: <the same if user not idle -1or true if 1 idle>
timeStamp:

In each doc I have string that can be Active or Disconnected.
I need to count how many times Active changed to Disconnected.

for example on picture it was 3 times.

4

I think this is the thing I'm having trouble understanding - how does this differ from counting the number of Disconnected values?

5

I want to know how many times the value has changed.

The counting the number of disabled records will show the total number of these records, for example, more than 100.

But there will be only a few moments when active becomes non-active.

6

The counting the number of disabled records will show the total number of these records, for example, more than 100.

So there might be multiple documents where the user's state is unchanged?

7

Yes, everything is correct and it does not change for some time.
Then it changes and when it happens I need to calculate.

8

@Den1

You either need to change how you ingest the data or post process the documents.

Here's a discussion around a similar need - Calculation time difference between two document

9

Thank you.
I'll take care about this in my script before post data to elastic.

The link that you gave me, I solved this problem by creating a document every minute. Which allowed me to calculate time.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.