How to: display table with multiple aggregations?

Hi there. As a newbie here I don't quite know how to phrase my question and title and thus also haven't been able to find a solution.

Kibana version 5.6.5.

I have logs of the following format:

The 'path' field represents different performance metrics, which are differentiated by the final suffix of the path (e.g. here the performance metric is 'unique_values' but it could be something like 'R_Squared' or 'MSE', as will be shown in the following).

I need to display a table using the Kibana Data Table metric 'Average' for the field 'Value'. This table should be averaged per performance metric, as follows (ignore the 'Task' column):

That is, for each CustomerID and BidderID I need to show the average value for each performance metric in a new column. The idea is to be able to easily compare BidderIDs along performance metric columns of interest. (e.g. if I want the BidderID with the lowest 'R_Squared' but not a huge 'MSE', I can sort on the 'R_squared' column and eyeball the corresponding 'MSE').

I've tried splitting the table on Terms using the 'path' field, which gives me one table per path value, i.e. per performance metric, which looks like this:

The problem here is it then also includes the CustomerID and BidderID in each separate table, which makes it impossible to do the type of comparison described above.

I think adding a json query in the advanced options might help but my queries have failed syntactically.

I think my issue is similar to this one(didn't help me) or this one (unanswered). Would really appreciate some advice!

Hi @KatherineMunro,

unfortunately the post you linked is summarizing the current state - you can't do this with the current table visualization. We are planning on implementing this feature in the new Lens visualization type as well - you can track the progress here: https://github.com/elastic/kibana/issues/61489

Till then, one option is to use the "enhanced table" plugin which contains the feature you are requesting: https://github.com/fbaligand/kibana-enhanced-table

Hi flash,

thanks for the quick response. I installed the plugin but it does not appear to have given me any new column options features: the only apparent change is that I now have 'Exclude' and 'Include' under the advanced options.

I have Kibana 5.6.5 and so I installed release enhanced-table-0.5.0_6.2.4.zip. Is my Kibana version too old?

Also, do you know any great instructional resources on how to use Enhanced Table? I'm not finding any.

I was referring to this feature listed in the readme:

Support for a new bucket type : 'Split Cols'. It lets to create a pivot table
When combined with computed columns, each computed column can be added per split column or after all split columns.

Your version might be too old, I'm not sure about that. When you are in doubt, you can create an issue in the github repo of the plugin.

Ah ok, so it should be here (but isn't for me)?

image

Seems like it, but it's probably better to ask this question in the github repo of the plugin.

Hi flash,

I resolved the install problem and enhanced table is working correctly. I've been asked to build a table with the following information:

where MSE, ABS Error, R2 etc are possible values of a single term. I'm currently using Split Cols to split on that term and show the average numeric value for each of those, which is fine for the columns MSE, ABS Error, R2 & max_abs_error. The column R2_last_day - R2_avg_shown should show the difference between the R2 on the previous day and the average R2 of the rest of the time period of data shown. Similarly, the column MSE_day / MSE_avg_shown should be the ratio of the MSE for the previous day to that of the rest of the shown MSE data. That is, both columns' information will vary depending on the time range selected in Kibana.

Is this at all possible with the Computed Columns option in Enhanced Table? The examples in the github repo haven't made that clear for me and I haven't been able to work it out myself. And I suspect it can't be done.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.