How to compare data in different sets of documents matched by their timestamp in Kibana

Elastic Stack Kibana
1

Hi,

I am new to Kibana and elasticsearch and run into a problem with some basic analysis, where I want to compare different sets of documents matched by their timestamp in Kibana

The situation is as follows:
We are uploading sensor data from different devices and I want to compare data of deviceA with data of deviceB.

This means data of both devices should be matched based on timestamp for analysis.
Analysis I would like to do with this data:

  • Plot sensordata of deviceA (yaxis) against deviceB (xaxis)
  • (average) difference between deviceA and deviceB
  • etc

Documents stored contain a device ID, timestamp and sensordata

Is this possible in Kibana? Is there an option to do some custom preprocessing of data in Kibana? Or would I need to add a plugin?

Thank you!

2

If both devices have timestamps in the same bucket(time interval), there shouldn't be any problem in getting them displayed on the same chart.
Can you post some examples on how a document looks like so we can get more of an idea?

3

Thanks for your reply! Yes they are at the same time interval.
This is an example document:

    {
      ...,
      "_source": {
        "deviceID": {
            "keyword": "deviceA"
        },
        "timestamp": 1586953800000,
        "co2": 448,
        "pm10": 8,
        ...
      }
    }

There is no problem displaying them in the same chart with time as x-axis.
But I want to be able to plot for example co2 of deviceA on the x-axis and co2 of deviceB on the y-axis.
An example:

example refgraph
example refgraph913×527 27 KB

For other analytics I am running into the same issue: I want to query deviceA and get the corresponding data of deviceB matching the timestamp of deviceA, and then do some comparisons and then display in kibana. I looked into canvas with sql which works nice, but then there are no subqueries suported to do this it seems?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.