How to do Calculation in Elasticsearch Query

[yuswanul]

Hi there,

to continue discussion below, I decided to create a new topic. please read the topic below first so you can understand it.

How to Show the Value of tags When Using Server Log Connector

Hello everyone, i want to ask something about alerting here. i already create a rule to notify me if there is a certificate that will be expire in few days through server log which is kibana.log like this [image] [image] Due to different types of certificates that exist, in which there is manual-renew and auto-renew, I want to display those tags in the message. so that the script that I made can be given conditions(if else) based on the value of field tags. What variables can I use to displa…

OK, so the next question is how if i use elasticsearch query to calculate expire date of a certificate using field below and I subtract it with today's date. is it possible?

if that is possible, maybe i can call the value of the tags field too so that my script can work with that

Thanks

[stephenb (Stephen Brown)]

You know Uptime/ Heartbeat does all that for you...cert check and alert.

But yes you can create a runtime field to calculate the difference assuming you are on a fairly recent version.

I had a post on that let me look

Perhaps this will help

Calculate elapsed time in Kibana?

Hi @TXBigDawg1836 Welcome to the community Yup add a runtime field to the Data View here is the code long datenow = new Date().getTime(); long datewas = doc['@timestamp'].value.getMillis(); emit (datenow - datewas); Create / Set the Field [Screen Shot 2022-10-13 at 1.23.42 PM] Chose your format.... [Screen Shot 2022-10-13 at 1.23.54 PM] In Discover [Screen Shot 2022-10-13 at 1.34.19 PM] Now Table... [Screen Shot 2022-10-13 at 1.26.49 PM]

[yuswanul]

@stephenb

You know Uptime/ Heartbeat does all that for you...cert check and alert.

sure, but i need to call the value of the tags field from heartbeat index to separate cert that have auto-renew tags, and manual-renew tags and it's not possible with TLS Cert type

[stephenb (Stephen Brown)]

Ok...Did you look at the example I gave you? It shows how to calculate elapsed time. You could add a runtime field to your mapping and it would always be available for you.

You could tag the cert checks as well heartbeat if you know the types when you can figure... Then the data would be there.

[yuswanul]

do you have example for 7.17 version? i didn't found Data Views menu in stack management here

[stephenb (Stephen Brown)]

It's under index pattern which is the 7.17 version of data views. Data views came in 8.x.

You can test it out in the index pattern, but if it's something that you're going to use quite a bit or query against you will actually need to add it to the mapping.

Get it working in the index pattern first which then you'll be able to see it in discover first and then we can translate it over to the mapping